CVE-2021-32000

clone-master-clean-up: dangerous file system operations

3.2 LowFix available

A UNIX Symbolic Link (Symlink) Following vulnerability in the clone-master-clean-up.sh script of clone-master-clean-up in SUSE Linux Enterprise Server 12 SP3, SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allows local attackers to delete arbitrary files. This issue affects: SUSE Linux Enterprise Server 12 SP3 clone-master-clean-up version 1.6-4.6.1 and prior versions. SUSE Linux Enterprise Server 15 SP1 clone-master-clean-up version 1.6-3.9.1 and prior versions. openSUSE Factory clone-master-clean-up version 1.6-1.4 and prior versions.

Attack profile

How easy it is to exploit

Attack vector: Physical
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: Low

Exploit likelihood

0.30%Up 0.1 points since Jul 29, 2021

What each source reports

CVE List Score used 3.2

clone-master-clean-up: dangerous file system operations

Record: CVE-2021-32000
CVSS 3.1: 3.2 LowCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated: 2026-11-02

EUVDEUVD-2021-18870 3.2

Record: EUVD-2021-18870
CVSS 3.1: 3.2 LowCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-54r8-8cq2-5p82 7.1

A UNIX Symbolic Link (Symlink) Following vulnerability in the clone-master-clean-up.sh script of...

Record: GHSA-54r8-8cq2-5p82
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-59, CWE-61
Updated: 2026-11-02

NVD 3.2

Record: CVE-2021-32000
CVSS 3.1: 3.2 LowCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0: 6.6 MediumAV:L/AC:L/Au:N/C:N/I:C/A:C
Weakness: CWE-59
Updated: 2026-11-02

OSVopenSUSE-SU-2024:12840-1 No score

clone-master-clean-up-1.11-1.1 on GA media

These are all security issues fixed in the clone-master-clean-up-1.11-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:12840-1
Updated: 2026-11-02

OSVSUSE-SU-2022:3667-1 No score

Security update for clone-master-clean-up

This update for clone-master-clean-up fixes the following issues:

CVE-2021-32000: Fixed some potentially dangerous file system operations (bsc#1181050).

Bugfixes:

Fixed clone-master-clean-up failing to remove btrfs snapshots (bsc#1203651).

Record: SUSE-SU-2022:3667-1
Updated: 2026-11-02

OSVSUSE-SU-2022:3674-1 No score

Security update for clone-master-clean-up

This update for clone-master-clean-up fixes the following issues:

CVE-2021-32000: Fixed some potentially dangerous file system operations (bsc#1181050).

Bugfixes:

Fixed failures to remove btrfs snapshots (bsc#1203651).

Record: SUSE-SU-2022:3674-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`clone-master-clean-up` SUSE:Linux Enterprise Module for Server Applications 15 SP3	before 1.8-150100.3.14.1	1.8-150100.3.14.1
`clone-master-clean-up` SUSE:Linux Enterprise Module for Server Applications 15 SP4	before 1.8-150100.3.14.1	1.8-150100.3.14.1
`clone-master-clean-up` openSUSE:Leap 15.3	before 1.8-150100.3.14.1	1.8-150100.3.14.1
`clone-master-clean-up` openSUSE:Leap 15.4	before 1.8-150100.3.14.1	1.8-150100.3.14.1
`clone-master-clean-up` SUSE:Linux Enterprise Server 12 SP5	before 1.8-4.11.1	1.8-4.11.1
`clone-master-clean-up` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	before 1.8-4.11.1	1.8-4.11.1
`clone-master-clean-up` openSUSE:Tumbleweed	before 1.11-1.1	1.11-1.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-32000 is a low vulnerability (CVSS 3.2) in Opensuse Factory, published July 28, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in clone-master-clean-up 1.8-150100.3.14.1.