What is the CVSS score of CVE-2020-13882?

CVE-2020-13882 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Lynis CVE-2020-13882

MEDIUM

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2020-06-18 cve@mitre.org

Authentication Bypass Lynis Fedora

4.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.2 MEDIUM

AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVE Published

Jun 18, 2020 - 18:15 nvd

MEDIUM 4.2

DescriptionNVD

CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks.

AnalysisAI

CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. Rated medium severity (CVSS 4.2). No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-367. CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks. Affected products include: Cisofy Lynis, Fedoraproject Fedora. Version information: before 3.0.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.