CVE-2024-52869

Certain Teradata account-handling code through 2024-11-04, used with SUSE Enterprise Linux Server, mismanages groups. Specifically, when there is an operating system move from SUSE Enterprise Linux Server (SLES) 12 Service Pack (SP) 2 or 3 to SLES 15 SP2 on Teradata Database systems, some service/system user accounts, and possibly systems administrator created user accounts, are incorrectly assigned to groups that allow higher system-level privileges than intended for those user accounts. Depending on the usage of these accounts, this may lead to full system compromise.

CVSS v3 6.0 MEDIUM

6.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://chrismanson.com/CVE/cve-2024-52869.html
https://www.teradata.com/trust-security-center/data-security

Configurations

No configuration.

History

No history.

Information

Published : 2025-01-08 21:15

Updated : 2025-01-31 18:15

NVD link : CVE-2024-52869

Mitre link : CVE-2024-52869

CVE.ORG link : CVE-2024-52869

JSON object : View

Products Affected

No product.

CWE

CWE-281

Improper Preservation of Permissions

{"id": "CVE-2024-52869", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 1.8}]}, "published": "2025-01-08T21:15:12.523", "references": [{"url": "https://chrismanson.com/CVE/cve-2024-52869.html", "source": "[email protected]"}, {"url": "https://www.teradata.com/trust-security-center/data-security", "source": "[email protected]"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-281"}]}], "descriptions": [{"lang": "en", "value": "Certain Teradata account-handling code through 2024-11-04, used with SUSE Enterprise Linux Server, mismanages groups. Specifically, when there is an operating system move from SUSE Enterprise Linux Server (SLES) 12 Service Pack (SP) 2 or 3 to SLES 15 SP2 on Teradata Database systems, some service/system user accounts, and possibly systems administrator created user accounts, are incorrectly assigned to groups that allow higher system-level privileges than intended for those user accounts. Depending on the usage of these accounts, this may lead to full system compromise."}, {"lang": "es", "value": "Ciertos c\u00f3digos de gesti\u00f3n de cuentas de Teradata hasta el 4 de noviembre de 2024, utilizados con SUSE Enterprise Linux Server, administran grupos de forma incorrecta. En concreto, cuando se produce un cambio de sistema operativo de SUSE Enterprise Linux Server (SLES) 12 Service Pack (SP) 2 o 3 a SLES 15 SP2 en sistemas de bases de datos Teradata, algunas cuentas de usuario de servicio o sistema, y posiblemente cuentas de usuario creadas por el administrador de sistemas, se asignan de forma incorrecta a grupos que permiten privilegios de nivel de sistema superiores a los previstos para esas cuentas de usuario. Seg\u00fan el uso de estas cuentas, esto puede provocar un compromiso total del sistema."}], "lastModified": "2025-01-31T18:15:34.633", "sourceIdentifier": "[email protected]"}