CVE-2020-8022: tomcat before 8.0.53-29.32.1 (exclusive), before 9.0.35-3.39.1 (exclusive), before 9.0.35-3.57.3 (exclusive); +15 more…

Affected technology

tomcat · before 8.0.53-29.32.1 (exclusive)
apache

tomcat · before 9.0.35-3.39.1 (exclusive)
apache

tomcat · before 9.0.35-3.57.3 (exclusive)
apache

leap · 15.1
opensuse

SUSE Enterprise Storage 5 · tomcat to before 8.0.53-29.32.1
SUSE

SUSE Linux Enterprise Server 12-SP2-BCL · tomcat to before 8.0.53-29.32.1
SUSE

SUSE Linux Enterprise Server 12-SP2-LTSS · tomcat to before 8.0.53-29.32.1
SUSE

SUSE Linux Enterprise Server 12-SP3-BCL · tomcat to before 8.0.53-29.32.1
SUSE

SUSE Linux Enterprise Server 12-SP3-LTSS · tomcat to before 8.0.53-29.32.1
SUSE

SUSE Linux Enterprise Server 12-SP4 · tomcat to before 9.0.35-3.39.1
SUSE

SUSE Linux Enterprise Server 12-SP5 · tomcat to before 9.0.35-3.39.1
SUSE

SUSE Linux Enterprise Server 15-LTSS · tomcat to before 9.0.35-3.57.3
SUSE

SUSE Linux Enterprise Server for SAP 12-SP2 · tomcat to before 8.0.53-29.32.1
SUSE

SUSE Linux Enterprise Server for SAP 12-SP3 · tomcat to before 8.0.53-29.32.1
SUSE

SUSE Linux Enterprise Server for SAP 15 · tomcat to before 9.0.35-3.57.3
SUSE

SUSE OpenStack Cloud 7 · tomcat to before 8.0.53-29.32.1
SUSE

SUSE OpenStack Cloud 8 · tomcat to before 8.0.53-29.32.1
SUSE

SUSE OpenStack Cloud Crowbar 8 · tomcat to before 8.0.53-29.32.1
SUSE

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Local · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

Local attackers can escalate from group tomcat to root. Vendor/CNA’s CVSS 3.1 assessment (base score 7.7/10) rates confidentiality and integrity impact as high; availability impact as none. NVD’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high.