User-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation of priviliges
Priority LOW 38CWE-276Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 6 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00857 58th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial SUSE Enterprise Storage 5 (SUSE): 8.0.53-29.32.1SUSE Linux Enterprise Server 12-SP2-BCL (SUSE): 8.0.53-29.32.1+12 more productsRed Hat: 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SUSE | SUSE Enterprise Storage 5 | tomcat to before 8.0.53-29.32.1 | 8.0.53-29.32.1 | Patch available | CNA |
| SUSE | SUSE Linux Enterprise Server 12-SP2-BCL | tomcat to before 8.0.53-29.32.1 | 8.0.53-29.32.1 | Patch available | CNA |
| SUSE | SUSE Linux Enterprise Server 12-SP2-LTSS | tomcat to before 8.0.53-29.32.1 | 8.0.53-29.32.1 | Patch available | CNA |
| SUSE | SUSE Linux Enterprise Server 12-SP3-BCL | tomcat to before 8.0.53-29.32.1 | 8.0.53-29.32.1 | Patch available | CNA |
| SUSE | SUSE Linux Enterprise Server 12-SP3-LTSS | tomcat to before 8.0.53-29.32.1 | 8.0.53-29.32.1 | Patch available | CNA |
| SUSE | SUSE Linux Enterprise Server 12-SP4 | tomcat to before 9.0.35-3.39.1 | 9.0.35-3.39.1 | Patch available | CNA |
| SUSE | SUSE Linux Enterprise Server 12-SP5 | tomcat to before 9.0.35-3.39.1 | 9.0.35-3.39.1 | Patch available | CNA |
| SUSE | SUSE Linux Enterprise Server 15-LTSS | tomcat to before 9.0.35-3.57.3 | 9.0.35-3.57.3 | Patch available | CNA |
| SUSE | SUSE Linux Enterprise Server for SAP 12-SP2 | tomcat to before 8.0.53-29.32.1 | 8.0.53-29.32.1 | Patch available | CNA |
| SUSE | SUSE Linux Enterprise Server for SAP 12-SP3 | tomcat to before 8.0.53-29.32.1 | 8.0.53-29.32.1 | Patch available | CNA |
| SUSE | SUSE Linux Enterprise Server for SAP 15 | tomcat to before 9.0.35-3.57.3 | 9.0.35-3.57.3 | Patch available | CNA |
| SUSE | SUSE OpenStack Cloud 7 | tomcat to before 8.0.53-29.32.1 | 8.0.53-29.32.1 | Patch available | CNA |
| SUSE | SUSE OpenStack Cloud 8 | tomcat to before 8.0.53-29.32.1 | 8.0.53-29.32.1 | Patch available | CNA |
| SUSE | SUSE OpenStack Cloud Crowbar 8 | tomcat to before 8.0.53-29.32.1 | 8.0.53-29.32.1 | Patch available | CNA |
- SUSE Enterprise Storage 5 VendorSUSE Affected tomcat to before 8.0.53-29.32.1 Fixed in 8.0.53-29.32.1 Patch available CNA
- SUSE Linux Enterprise Server 12-SP2-BCL VendorSUSE Affected tomcat to before 8.0.53-29.32.1 Fixed in 8.0.53-29.32.1 Patch available CNA
- SUSE Linux Enterprise Server 12-SP2-LTSS VendorSUSE Affected tomcat to before 8.0.53-29.32.1 Fixed in 8.0.53-29.32.1 Patch available CNA
- SUSE Linux Enterprise Server 12-SP3-BCL VendorSUSE Affected tomcat to before 8.0.53-29.32.1 Fixed in 8.0.53-29.32.1 Patch available CNA
- SUSE Linux Enterprise Server 12-SP3-LTSS VendorSUSE Affected tomcat to before 8.0.53-29.32.1 Fixed in 8.0.53-29.32.1 Patch available CNA
- SUSE Linux Enterprise Server 12-SP4 VendorSUSE Affected tomcat to before 9.0.35-3.39.1 Fixed in 9.0.35-3.39.1 Patch available CNA
- SUSE Linux Enterprise Server 12-SP5 VendorSUSE Affected tomcat to before 9.0.35-3.39.1 Fixed in 9.0.35-3.39.1 Patch available CNA
- SUSE Linux Enterprise Server 15-LTSS VendorSUSE Affected tomcat to before 9.0.35-3.57.3 Fixed in 9.0.35-3.57.3 Patch available CNA
- SUSE Linux Enterprise Server for SAP 12-SP2 VendorSUSE Affected tomcat to before 8.0.53-29.32.1 Fixed in 8.0.53-29.32.1 Patch available CNA
- SUSE Linux Enterprise Server for SAP 12-SP3 VendorSUSE Affected tomcat to before 8.0.53-29.32.1 Fixed in 8.0.53-29.32.1 Patch available CNA
- SUSE Linux Enterprise Server for SAP 15 VendorSUSE Affected tomcat to before 9.0.35-3.57.3 Fixed in 9.0.35-3.57.3 Patch available CNA
- SUSE OpenStack Cloud 7 VendorSUSE Affected tomcat to before 8.0.53-29.32.1 Fixed in 8.0.53-29.32.1 Patch available CNA
- SUSE OpenStack Cloud 8 VendorSUSE Affected tomcat to before 8.0.53-29.32.1 Fixed in 8.0.53-29.32.1 Patch available CNA
- SUSE OpenStack Cloud Crowbar 8 VendorSUSE Affected tomcat to before 8.0.53-29.32.1 Fixed in 8.0.53-29.32.1 Patch available CNA
CPE configurations NVD · 17
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | before 8.0.53-29.32.1 | Vulnerable | Apache |
| cpe:2.3:a:suse:enterprise_storage:5.0:*:*:*:*:*:*:* | 5.0 | Running on | SUSE |
| cpe:2.3:o:suse:linux_enterprise_server:12:sp2:*:*:*:*:*:* | 12 sp2 | Running on | SUSE |
| cpe:2.3:o:suse:linux_enterprise_server:12:sp2:*:*:ltss:*:*:* | 12 sp2 | Running on | SUSE |
| cpe:2.3:o:suse:linux_enterprise_server:12:sp3:*:*:*:*:*:* | 12 sp3 | Running on | SUSE |
| cpe:2.3:o:suse:linux_enterprise_server:12:sp3:*:*:ltss:*:*:* | 12 sp3 | Running on | SUSE |
| cpe:2.3:o:suse:linux_enterprise_server:12:sp2:*:*:*:sap:*:* | 12 sp2 | Running on | SUSE |
| cpe:2.3:o:suse:linux_enterprise_server:12:sp3:*:*:*:sap:*:* | 12 sp3 | Running on | SUSE |
| cpe:2.3:a:suse:openstack_cloud:7.0:*:*:*:*:*:*:* | 7.0 | Running on | SUSE |
| cpe:2.3:a:suse:openstack_cloud:8.0:*:*:*:*:*:*:* | 8.0 | Running on | SUSE |
- cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions before 8.0.53-29.32.1 Vulnerable ·Apache
- cpe:2.3:a:suse:enterprise_storage:5.0:*:*:*:*:*:*:* Versions 5.0 Running on ·SUSE
- cpe:2.3:o:suse:linux_enterprise_server:12:sp2:*:*:*:*:*:* Versions 12 sp2 Running on ·SUSE
- cpe:2.3:o:suse:linux_enterprise_server:12:sp2:*:*:ltss:*:*:* Versions 12 sp2 Running on ·SUSE
- cpe:2.3:o:suse:linux_enterprise_server:12:sp3:*:*:*:*:*:* Versions 12 sp3 Running on ·SUSE
- cpe:2.3:o:suse:linux_enterprise_server:12:sp3:*:*:ltss:*:*:* Versions 12 sp3 Running on ·SUSE
- cpe:2.3:o:suse:linux_enterprise_server:12:sp2:*:*:*:sap:*:* Versions 12 sp2 Running on ·SUSE
- cpe:2.3:o:suse:linux_enterprise_server:12:sp3:*:*:*:sap:*:* Versions 12 sp3 Running on ·SUSE
- cpe:2.3:a:suse:openstack_cloud:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·SUSE
- cpe:2.3:a:suse:openstack_cloud:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·SUSE
Show 7 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:suse:openstack_cloud_crowbar:8.0:*:*:*:*:*:*:* | 8.0 | Running on | SUSE |
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | before 9.0.35-3.39.1 | Vulnerable | Apache |
| cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:*:*:*:* | 12 sp4 | Running on | SUSE |
| cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:*:*:*:* | 12 sp5 | Running on | SUSE |
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | before 9.0.35-3.57.3 | Vulnerable | Apache |
| cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:sap:*:* | 15 | Running on | SUSE |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
- cpe:2.3:a:suse:openstack_cloud_crowbar:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·SUSE
- cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions before 9.0.35-3.39.1 Vulnerable ·Apache
- cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:*:*:*:* Versions 12 sp4 Running on ·SUSE
- cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:*:*:*:* Versions 12 sp5 Running on ·SUSE
- cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions before 9.0.35-3.57.3 Vulnerable ·Apache
- cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:sap:*:* Versions 15 Running on ·SUSE
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
Remediation
- Fix · CNA SUSE Enterprise Storage 5 (SUSE) Fixed in 8.0.53-29.32.1
- Fix · CNA SUSE Linux Enterprise Server 12-SP2-BCL (SUSE) Fixed in 8.0.53-29.32.1
- Fix · CNA SUSE Linux Enterprise Server 12-SP2-LTSS (SUSE) Fixed in 8.0.53-29.32.1
- Fix · CNA SUSE Linux Enterprise Server 12-SP3-BCL (SUSE) Fixed in 8.0.53-29.32.1
- Fix · CNA SUSE Linux Enterprise Server 12-SP3-LTSS (SUSE) Fixed in 8.0.53-29.32.1
- Fix · CNA SUSE Linux Enterprise Server 12-SP4 (SUSE) Fixed in 9.0.35-3.39.1
- Fix · CNA SUSE Linux Enterprise Server 12-SP5 (SUSE) Fixed in 9.0.35-3.39.1
- Fix · CNA SUSE Linux Enterprise Server 15-LTSS (SUSE) Fixed in 9.0.35-3.57.3
- Fix · CNA SUSE Linux Enterprise Server for SAP 12-SP2 (SUSE) Fixed in 8.0.53-29.32.1
- Fix · CNA SUSE Linux Enterprise Server for SAP 12-SP3 (SUSE) Fixed in 8.0.53-29.32.1
- Fix · CNA SUSE Linux Enterprise Server for SAP 15 (SUSE) Fixed in 9.0.35-3.57.3
- Fix · CNA SUSE OpenStack Cloud 7 (SUSE) Fixed in 8.0.53-29.32.1
- Fix · CNA SUSE OpenStack Cloud 8 (SUSE) Fixed in 8.0.53-29.32.1
- Fix · CNA SUSE OpenStack Cloud Crowbar 8 (SUSE) Fixed in 8.0.53-29.32.1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Data Grid 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
Not affected: 9 products
- Red Hat Decision Manager 7
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Fuse 7
- Red Hat JBoss Web Server 3
- Red Hat JBoss Web Server 5
- Red Hat Process Automation 7
- Red Hat support for Spring Boot
Timeline
- 2026-10-02 Threatist record created from CVE-2020-8022
- 2026-10-08 CISA SSVC decision points changed
References
Advisory 1
Other 4
- [tomcat-users] 20200902 Re: regarding CVE-2020-8022 applicable to tomcat 8.5.57
- [tomcat-users] 20200902 regarding CVE-2020-8022 applicable to tomcat 8.5.57
- [axis-java-dev] 20210228 axis2 1.7.9 is exposed to CVE-2020-8022 via tomcat dependency
- [axis-java-dev] 20210307 Re: axis2 1.7.9 is exposed to CVE-2020-8022 via tomcat dependency
More SUSE vulnerabilities
- TI-2016-03560 Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote… KEVCVSS 3.1CRITICAL 9.8
- TI-2016-03506 Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
- TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-04302 Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-04301 Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-04298 Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-8022 · CVE Program
- CVE-2020-8022 · NVD
- FIRST EPSS
- CVE-2020-8022 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences