PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2021-25317

CVE-2021-25317

cups: insecure permissions of /var/log/cups allows for symlink attacks

Loading…

Severity

Low

Red Hat Product Security

2

CVSS 3.1

Review impact separately from score.

Published · April 29, 2021

Updated · October 9, 2026

Description

It was found that some Linux vendors may assign the ownership of the /var/log/cups directory to the lp user. This could allow an attacker with such privileges to create empty files in arbitrary locations, or to force arbitrary files to be opened and closed, using a symlink attack. This has a low impact on the integrity of the system.

Statement

This issue does not affect the upstream CUPS, only the CUPS versions as packaged by some OS vendors.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 2
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

CWE-276 · Incorrect Default Permissions