CWE Code: 269
Vulnerability Type: privilege_escalation
CVSS Score: 10.0
CWE Name:  Improper Privilege Management
Summary: the nfs-utils package in suse linux enterprise server 12 before and including version 1.3.0-34.18.1 and in suse linux enterprise server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. this directory contains files owned and managed by root. if statd is compromised, it can therefore trick processes running with root privileges into creating/overwriting files anywhere on the system.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2019-09-19
Last Modified Date: 2019-10-15