CVE-2020-8022
User-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation of priviliges
- State
- Published
- Severity
- 7.7 High
- Published
- Jun 29, 2020
- Updated
- Oct 8, 2026
- Reserved
- Jan 27, 2020
Description
A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.7 High | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | suse |
Weaknesses
- CWE-276 Incorrect Default Permissions
Affected Products
| Product | Versions |
|---|---|
SUSE Enterprise Storage 5SUSE |
|
SUSE Linux Enterprise Server 12-SP2-BCLSUSE |
|
SUSE Linux Enterprise Server 12-SP2-LTSSSUSE |
|
SUSE Linux Enterprise Server 12-SP3-BCLSUSE |
|
SUSE Linux Enterprise Server 12-SP3-LTSSSUSE |
|
SUSE Linux Enterprise Server 12-SP4SUSE |
|
SUSE Linux Enterprise Server 12-SP5SUSE |
|
SUSE Linux Enterprise Server 15-LTSSSUSE |
|
SUSE Linux Enterprise Server for SAP 12-SP2SUSE |
|
SUSE Linux Enterprise Server for SAP 12-SP3SUSE |
|
SUSE Linux Enterprise Server for SAP 15SUSE |
|
SUSE OpenStack Cloud 7SUSE |
|
SUSE OpenStack Cloud 8SUSE |
|
SUSE OpenStack Cloud Crowbar 8SUSE |
|
References
- https://bugzilla.suse.com/show_bug.cgi?id=1172405
- openSUSE-SU-2020:0911vendor-advisory
- [tomcat-users] 20200902 Re: regarding CVE-2020-8022 applicable to tomcat 8.5.57mailing-list
- [tomcat-users] 20200902 regarding CVE-2020-8022 applicable to tomcat 8.5.57mailing-list
- [axis-java-dev] 20210228 axis2 1.7.9 is exposed to CVE-2020-8022 via tomcat dependencymailing-list
- [axis-java-dev] 20210307 Re: axis2 1.7.9 is exposed to CVE-2020-8022 via tomcat dependencymailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.