Description
Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root
Published: 2024-10-16
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-19635 Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root
History

Sat, 12 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00016}

 epss

{'score': 0.00017}

Mon, 27 Jan 2025 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 16 Oct 2024 13:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in the Tomcat package of OpenSUSE and derived distributions. This issue occurs due to incorrect permissions and a race condition in the %post section of the Tomcat RPM package, resulting in local privilege escalation when the Tomcat package is re-installed. Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root
Title tomcat: Escalation to root from tomcat user via %post script tomcat packaging allows for escalation to root from tomcat user
Weaknesses CWE-732
References
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: suse

Published:

Updated: 2025-08-26T20:18:11.916Z

Reserved: 2024-01-04T12:38:34.023Z

Link: CVE-2024-22029

cve-icon Vulnrichment

Updated: 2025-01-27T17:55:51.195Z

cve-icon NVD

Status : Deferred

Published: 2024-10-16T14:15:04.500

Modified: 2026-04-15T00:35:42.020

Link: CVE-2024-22029

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-02-14T00:00:00Z

Links: CVE-2024-22029 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses