{"id":"CVE-2020-8032","aliases":["ALPINE-CVE-2020-8032","AZL-6370","BELL-CVE-2020-8032","EUVD-2020-28944","GHSA-rg43-4x9m-w9jh","openSUSE-SU-2024:10709-1"],"status":"published","title":"Local privilege escalation to root due to insecure tmp file usage","description":"A Insecure Temporary File vulnerability in the packaging of cyrus-sasl of openSUSE Factory allows local attackers to escalate to root. This issue affects: openSUSE Factory cyrus-sasl version 2.1.27-4.2 and prior versions.","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00352,"percentile":0.2905,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-377"],"published":"2021-02-25T09:15:17Z","modified":"2026-07-14T08:03:28Z","fixes":[{"ecosystem":"Azure Linux:2","package":"cyrus-sasl","fixed_in":["2.1.27-10"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27-10"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cyrus-sasl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.27-5.7"}]}],"bundled":2}],"products":[{"vendor":"opensuse","product":"cyrus-sasl"},{"vendor":"opensuse","product":"factory"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1180669","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8032","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rg43-4x9m-w9jh"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-8032","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-8032","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8032","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-8032","title":"Local privilege escalation to root due to insecure tmp file usage","description":"A Insecure Temporary File vulnerability in the packaging of cyrus-sasl of openSUSE Factory allows local attackers to escalate to root. This issue affects: openSUSE Factory cyrus-sasl version 2.1.27-4.2 and prior versions.","status":"published","published":"2021-02-25T09:15:17.275Z","modified":"2024-09-16T20:03:06.806Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T14:35:50.88562Z"}],"euvd":[{"id":"EUVD-2020-28944","description":"A Insecure Temporary File vulnerability in the packaging of cyrus-sasl of openSUSE Factory allows local attackers to escalate to root. This issue affects: openSUSE Factory cyrus-sasl version 2.1.27-4.2 and prior versions.","status":"published","published":"2021-02-25T09:15:17Z","modified":"2024-09-16T20:03:06Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T00:55:17.735013Z"}],"ghsa":[{"id":"GHSA-rg43-4x9m-w9jh","title":"A Insecure Temporary File vulnerability in the packaging of cyrus-sasl of openSUSE Factory allows...","description":"A Insecure Temporary File vulnerability in the packaging of cyrus-sasl of openSUSE Factory allows local attackers to escalate to root. This issue affects: openSUSE Factory cyrus-sasl version 2.1.27-4.2 and prior versions.","status":"published","published":"2022-05-24T17:43:02Z","modified":"2023-01-29T05:05:31Z","cwes":["CWE-377"],"updated_at":"2026-11-02T14:45:48.864861Z"}],"nvd":[{"id":"CVE-2020-8032","description":"A Insecure Temporary File vulnerability in the packaging of cyrus-sasl of openSUSE Factory allows local attackers to escalate to root. This issue affects: openSUSE Factory cyrus-sasl version 2.1.27-4.2 and prior versions.","status":"published","published":"2021-02-25T10:15:12.773Z","modified":"2026-06-17T03:25:49.59Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.9,"vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T14:06:37.687844Z"}],"osv":[{"id":"ALPINE-CVE-2020-8032","description":"A Insecure Temporary File vulnerability in the packaging of cyrus-sasl of openSUSE Factory allows local attackers to escalate to root. This issue affects: openSUSE Factory cyrus-sasl version 2.1.27-4.2 and prior versions.","status":"withdrawn","published":"2021-02-25T10:15:12.773Z","modified":"2026-07-14T08:03:28.3170708Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"AZL-6370","title":"CVE-2020-8032 affecting package cyrus-sasl for versions less than 2.1.27-10","description":"A Insecure Temporary File vulnerability in the packaging of cyrus-sasl of openSUSE Factory allows local attackers to escalate to root. This issue affects: openSUSE Factory cyrus-sasl version 2.1.27-4.2 and prior versions.","status":"published","published":"2021-02-25T10:15:12Z","modified":"2026-04-21T04:32:11.95488Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"BELL-CVE-2020-8032","title":"CVE-2020-8032 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:29.976822Z","modified":"2026-03-05T07:15:25.55915Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-8032","description":"A Insecure Temporary File vulnerability in the packaging of cyrus-sasl of openSUSE Factory allows local attackers to escalate to root. This issue affects: openSUSE Factory cyrus-sasl version 2.1.27-4.2 and prior versions.","status":"published","published":"2021-02-25T10:15:12.773Z","modified":"2026-03-14T01:39:19.875759Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:17.34531Z"},{"id":"openSUSE-SU-2024:10709-1","title":"cyrus-sasl-2.1.27-5.7 on GA media","description":"These are all security issues fixed in the cyrus-sasl-2.1.27-5.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:50:05.03523Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}