{"id":"CVE-2020-8025","aliases":["EUVD-2020-28937","GHSA-g55h-q572-52j6","SUSE-SU-2021:0197-1","SUSE-SU-2021:1292-1","SUSE-SU-2022:1509-1","SUSE-SU-2022:1873-1"],"status":"published","title":"outdated entries in permissions profiles for /var/lib/pcp/tmp/* may cause security issues","description":"A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00475,"percentile":0.41346,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-279"],"published":"2020-08-07T10:10:14Z","modified":"2026-06-17T03:25:48Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"permissions","fixed_in":["20181224-23.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"pcp","fixed_in":["3.11.9-5.11.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"pcp","fixed_in":["3.11.9-5.11.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"pcp","fixed_in":["3.11.9-5.11.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"pcp","fixed_in":["3.11.9-5.11.5"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"pcp","fixed_in":["3.11.9-150000.5.14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"pcp","fixed_in":["3.11.9-150000.5.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"pcp","fixed_in":["3.11.9-6.17.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20181224-23.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.9-5.11.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.9-5.11.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.9-5.11.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.9-5.11.5"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.9-150000.5.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.9-150000.5.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.9-6.17.1"}]}]}],"products":[{"vendor":"opensuse","product":"opensuse leap 15.1"},{"vendor":"opensuse","product":"opensuse tumbleweed"},{"vendor":"suse","product":"linux_enterprise_high_performance_computing"},{"vendor":"suse","product":"linux_enterprise_server"},{"vendor":"suse","product":"linux_enterprise_software_development_kit"},{"vendor":"suse","product":"opensuse tumbleweed"},{"vendor":"suse","product":"suse linux enterprise server 12-sp4"},{"vendor":"suse","product":"suse linux enterprise server 15-ltss"},{"vendor":"suse","product":"suse linux enterprise server for sap 15"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1171883","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8025"},{"url":"https://github.com/advisories/GHSA-g55h-q572-52j6"},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210197-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1171883","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8025","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211292-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1123311","tags":["report"]},{"url":"https://bugzilla.suse.com/1181571","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221509-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221873-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-8025","title":"outdated entries in permissions profiles for /var/lib/pcp/tmp/* may cause security issues","description":"A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624.","status":"published","published":"2020-08-07T10:10:14.243Z","modified":"2024-09-16T19:09:19.442Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-279"],"updated_at":"2026-11-02T14:35:50.88562Z"}],"euvd":[{"id":"EUVD-2020-28937","description":"A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624.","status":"published","published":"2020-08-07T10:10:14Z","modified":"2024-09-16T19:09:19Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:55:25.778976Z"}],"ghsa":[{"id":"GHSA-g55h-q572-52j6","title":"A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux...","description":"A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624.","status":"published","published":"2022-05-24T17:25:05Z","modified":"2023-01-29T05:03:29Z","updated_at":"2026-11-02T14:45:19.964025Z"}],"nvd":[{"id":"CVE-2020-8025","description":"A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624.","status":"published","published":"2020-08-07T10:15:11.75Z","modified":"2026-06-17T03:25:48.747Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-279"],"updated_at":"2026-11-02T14:06:10.994748Z"}],"osv":[{"id":"SUSE-SU-2021:0197-1","title":"Security update for permissions","description":"This update for permissions fixes the following issues:\n\n- Update to version 20181224:\n  * pcp: remove no longer needed / conflicting entries\n         (bsc#1171883, CVE-2020-8025)\n","status":"published","published":"2021-01-22T14:17:45Z","modified":"2026-02-04T02:53:24.514264Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:1292-1","title":"Security update for pcp","description":"This update for pcp fixes the following issues:\n\n- Fixed completely CVE-2020-8025 (bsc#1171883)\n","status":"published","published":"2021-04-21T12:06:26Z","modified":"2026-02-04T04:35:56.002246Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2022:1509-1","title":"Security update for pcp","description":"This update for pcp fixes the following issues:\n\n- CVE-2020-8025: Fixed outdated entries in permissions profiles for /var/lib/pcp/tmp/* (bsc#1171883).\n","status":"published","published":"2022-05-03T14:08:54Z","modified":"2026-02-04T02:24:01.278355Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1873-1","title":"Security update for pcp","description":"This update for pcp fixes the following issues:\n\n- CVE-2020-8025: Fixed outdated entries in permissions profiles for /var/lib/pcp/tmp/* (bsc#1171883).\n","status":"published","published":"2022-05-27T13:28:56Z","modified":"2026-02-04T03:53:04.678244Z","updated_at":"2026-11-02T15:53:50.513981Z"}]}}