CVE-2021-25317

cups: ownership of /var/log/cups allows the lp user to create files as root

State: Published
Severity: 3.3 Low
Published: May 5, 2021
Updated: Oct 8, 2026
Reserved: Jan 19, 2021

Description

A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with 0644 permissions without the ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1 and prior versions.

Scores

CVSS	Score	Vector	Source
3.1	3.3 Low	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	suse

Weaknesses

CWE-276 Incorrect Default Permissions

Affected Products

Product	Versions
SUSE Linux Enterprise Server 11-SP4-LTSSSUSE	cups to before 1.3.9Affected
SUSE Manager Server 4.0SUSE	cups to before 2.2.7Affected
SUSE OpenStack Cloud Crowbar 9SUSE	cups to before 1.7.5Affected
openSUSE Leap 15.2openSUSE	cups to before 2.2.7Affected
FactoryopenSUSE	cups through 2.3.3op2-2.1Affected

References

https://bugzilla.suse.com/show_bug.cgi?id=1184161
FEDORA-2021-dc578ce534vendor-advisory
FEDORA-2021-7b698513d5vendor-advisory
FEDORA-2021-be95e017e7vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.