CVE-2019-3694— Local privilege escalation from munin to root in the packaging of munin
Quick assessment
Affected
openSUSE Factory
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
openSUSE是德国SUSE公司的一套基于Linux的自由操作系统与开源社区项目。 openSUSE Factory中的munin 2.0.49-4.2及之前版本和openSUSE Leap 15.1版本中的munin 2.0.40-lp151.1.1及之前版本存在后置链接漏洞。本地攻击者可利用该漏洞提升权限至root。
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2019-3694
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Local privilege escalation from munin to root in the packaging of munin
Source: CVE Program / CVE List V5
Vulnerability Description
A Symbolic Link (Symlink) Following vulnerability in the packaging of munin in openSUSE Factory, Leap 15.1 allows local attackers to escalate from user munin to root. This issue affects: openSUSE Factory munin version 2.0.49-4.2 and prior versions. openSUSE Leap 15.1 munin version 2.0.40-lp151.1.1 and prior versions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: CVE Program / CVE List V5
Vulnerability Title
SUSE openSUSE 后置链接漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
openSUSE是德国SUSE公司的一套基于Linux的自由操作系统与开源社区项目。 openSUSE Factory中的munin 2.0.49-4.2及之前版本和openSUSE Leap 15.1版本中的munin 2.0.40-lp151.1.1及之前版本存在后置链接漏洞。本地攻击者可利用该漏洞提升权限至root。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2019-3694
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2019-3694
请登录查看更多情报信息。
Vendor Advisories for CVE-2019-3694 (1)
-
https://bugzilla.suse.com/show_bug.cgi?id=1155078 x_refsource_CONFIRM
Same Patch Batch · openSUSE · 2020-01-24 · 4 CVEs total
| CVE-2019-3697 | 7.7 HIGH | Local privilege escalation from user gnump3d to root |
| CVE-2019-3699 | 7.7 HIGH | Local privilege escalation from user privoxy to root |
| CVE-2019-3700 | 2.9 LOW | yast: Fallback to DES without configuration in /etc/login.def |
IV. Related Vulnerabilities
Same product: Factory
-
CVE-2022-31253
openldap2: /usr/lib/openldap/start allows ldap user/group to -
CVE-2022-21946
suddoers configuration for cscreen not restrictive enough -
CVE-2022-21945
cscreen: usage of fixed path /tmp/cscreen.debug -
CVE-2021-36781
parsec: dangerous 777 permissions for /run/parsec -
CVE-2021-25319
virtualbox: missing sticky bit for /etc/vbox allows local ro
Same vendor: openSUSE
-
CVE-2026-48863
Libsolv: stack-based buffer overflow in libsolv eddsa pgp si -
CVE-2026-56004
obs-service-tar_scm: command injection via mercurial handler -
CVE-2026-25701
openSUSE sdbootutil 安全漏洞 -
CVE-2025-53881
SUSE-specific logrotate configuration allows escalation from -
CVE-2025-46810
openSUSE Tumbleweed 安全漏洞
Same weakness: CWE-59
-
CVE-2026-103263
Tornado before 6.5.9 StaticFileHandler Path Traversal via Sy -
CVE-2026-102113
Kiteworks Core Local Privilege Escalation -
CVE-2026-102118
Kiteworks Core before version 9.5.0 is vulnerable to Local P -
CVE-2026-81310
Linux图像扫描驱动存在链接跟随漏洞 -
CVE-2026-102242
Path Traversal via Symlink Following in allowedLocalRoots in
V. Comments for CVE-2019-3694
No comments yet