CVE-2017-18285 The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveragin...
HighCVSS 7.1
EPSS 0.31%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to obtain read and write access to arbitrary files by leveraging access to a certain account for a burp-server.conf change.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| burp project burp | < 2.1.32 | 2.1.32 |
References
- bugs.gentoo.org issue-tracking third-party-advisory
- GLSA-201806-03 vendor-advisory
- GLSA-201904-05 vendor-advisory
- Debian Security Tracker CVE-2017-18285 vendor-advisory