PatchTheCVECVE-2020-13882: CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition
CVE-2020-13882 is a medium-severity flaw (CVSS 4.2) affecting lynis, fedora. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.2 (Medium) |
| Attack vector | Local |
| Attack complexity | High |
| Privileges needed | Low |
| User interaction | Required |
| EPSS exploit chance | 0.3% (top 83%) |
| CISA exploited list | No |
| Weakness | CWE-367 |
| Published | 2020-06-18 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-13882?
lynis: upgrade to 3.0.0; fedora: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2020-13882 being exploited?
CVE-2020-13882 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-13882 affect?
CVE-2020-13882 affects lynis, fedora. Severity is medium (CVSS 4.2). CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivile
How urgent is CVE-2020-13882?
Priority 19/100. No elevated risk signals yet.
Related CVEs
- CVE-2019-13033 LOW 3.3 UPGRADE MITIGATE In CISOfy Lynis 2.x through 2.7.5, the license key can be obtained by looking at the process list when a data