Published: 07/10/2020 Updated: 07/11/2023

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 641

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Sympa up to and including 6.2.57b.2 allows a local privilege escalation from the sympa user account to full root access by modifying the sympa.conf configuration file (which is owned by sympa) and parsing it through the setuid sympa_newaliases-wrapper executable.

Vulnerable Product	Search on Vulmon	Subscribe to Product
sympa sympa 6.2.57
sympa sympa
fedoraproject fedora 32
fedoraproject fedora 33
fedoraproject fedora 34
debian debian linux 9.0

Debian Bug report logs - #976020 sympa: CVE-2020-29668: Unauthorized access to review call of the SOAP API Package: sympa; Maintainer for sympa is Debian Sympa team <sympa@packagesdebianorg>; Source for sympa is src:sympa (PTS, buildd, popcon) Reported by: "Stefan Hornburg (Racke)" <racke@linuxiade> Date: Sat, 28 ...

Debian Bug report logs - #972114 sympa: CVE-2020-26880 Package: src:sympa; Maintainer for src:sympa is Debian Sympa team <sympa@packagesdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 12 Oct 2020 20:12:02 UTC Severity: important Tags: security, upstream Found in versions sympa/6240~d ...

Several vulnerabilities were discovered in Sympa, a mailing list manager, which could result in local privilege escalation, denial of service or unauthorized access via the SOAP API Additionally to mitigate CVE-2020-26880 the sympa_newaliases-wrapper is no longer installed setuid root by default A new Debconf question is introduced to allow setui ...

CWE-269 https://github.com/sympa-community/sympa/issues/943#issuecomment-704779420 https://github.com/sympa-community/sympa/issues/943#issuecomment-704842235 https://github.com/sympa-community/sympa/issues/1009 https://lists.debian.org/debian-lts-announce/2020/11/msg00015.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2TKOL454ZKKLQCUSUPNEZ52WELN4OAH/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5CUVLHGWCDA6B2NH467ZMKL6O2NGLQZN/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5MFWWYY4TSQAXBWZ6SBFX43BLUL3WWI/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976020 https://www.debian.org/security/2020/dsa-4818 https://nvd.nist.gov

CVE-2020-26880

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect