CVE-2019-18900

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

: Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp versions prior to 16.21.2-27.68.1. SUSE Linux Enterprise Server 12 libzypp versions prior to 16.21.2-2.45.1. SUSE Linux Enterprise Server 15 17.19.0-3.34.1.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-276

Affected software

VendorProductVersions
SUSECaaS Platform 3.0>= libzypp, < 16.21.2-27.68.1
SUSESUSE Linux Enterprise Server 12>= libzypp, < 16.21.2-2.45.1
SUSESUSE Linux Enterprise Server 15libzypp 17.19.0-3.34.1

References

Timeline

Published
Jan 24, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-189015.5A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server CVE-2019-189029.8A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory alCVE-2019-189039.8A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory alCVE-2019-189047.5A Uncontrolled Resource Consumption vulnerability in rmt of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux EnterpriseCVE-2019-189055.9A Insufficient Verification of Data Authenticity vulnerability in autoyast2 of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise ServerCVE-2019-189069.8A Improper Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackersCVE-2019-189098.0The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands thatCVE-2019-18917.5A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Managed Switches could allow an unauthenticated, remotCVE-2019-189106.8The Citrix Receiver wrapper function does not safely handle user supplied input, which may be leveraged by an attacker to inject commands thCVE-2019-189127.8A potential security vulnerability has been identified for certain HP printers and MFPs with Troy solutions. For affected printers with FutuCVE-2019-189136.8A potential security vulnerability with pre-boot DMA may allow unauthorized UEFI code execution using open-case attacks. This industry-wide CVE-2019-189146.1A potential security vulnerability has been identified for certain HP printers and MFPs that would allow redirection page Cross-Site Scripti
CVE-2019-18900: Low severity, CVSS 3.3 | Vulnix