CVE-2020-15397

HylaFAX+ through 7.0.2 and HylaFAX Enterprise have scripts that execute binaries from directories writable by unprivileged users (e.g., locations under /var/spool/hylafax that are writable by the uucp account). This allows these users to execute code in the context of the user calling these binaries (often root).

• CWE-732

• https://lists.opensuse.org/opensuse-security-announce/2020-08/msg00039.html
• https://lists.opensuse.org/opensuse-security-announce/2020-08/msg00040.html
• https://lists.opensuse.org/opensuse-security-announce/2020-08/msg00046.html
• https://lists.opensuse.org/opensuse-security-announce/2020-09/msg00054.html
• https://bugzilla.suse.com/show_bug.cgi?id=1173519Exploit, Issue Tracking, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J52QFVREJWJ35YSEEDDRMZQ2LM2H2WE6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y46FOVJUS5SO44A2VEKR7DXEHTI4WK5L/
• https://security.gentoo.org/glsa/202007-06
• https://sourceforge.net/p/hylafax/HylaFAX+/2534/Patch, Third Party Advisory
• https://lists.opensuse.org/opensuse-security-announce/2020-08/msg00039.html
• https://lists.opensuse.org/opensuse-security-announce/2020-08/msg00040.html
• https://lists.opensuse.org/opensuse-security-announce/2020-08/msg00046.html
• https://lists.opensuse.org/opensuse-security-announce/2020-09/msg00054.html
• https://bugzilla.suse.com/show_bug.cgi?id=1173519Exploit, Issue Tracking, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J52QFVREJWJ35YSEEDDRMZQ2LM2H2WE6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y46FOVJUS5SO44A2VEKR7DXEHTI4WK5L/
• https://security.gentoo.org/glsa/202007-06
• https://sourceforge.net/p/hylafax/HylaFAX+/2534/Patch, Third Party Advisory

Published

Jun 30, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15391The UI in DevSpace 4.13.0 allows web sites to execute action…9.8
• CVE-2020-15392A user enumeration vulnerability flaw was found in Venki Sup…5.3
• CVE-2020-15393In the Linux kernel 4.4 through 5.7.6, usbtest_disconnect in…5.5
• CVE-2020-15394The REST API in Zoho ManageEngine Applications Manager befor…9.8
• CVE-2020-15395In MediaInfoLib in MediaArea MediaInfo 20.03, there is a sta…7.8
• CVE-2020-15396In HylaFAX+ through 7.0.2 and HylaFAX Enterprise, the faxset…7.8
• CVE-2020-1540An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15400CakePHP before 4.0.6 mishandles CSRF token generation. This …4.3
• CVE-2020-15401IOBit Malware Fighter Pro 8.0.2.547 allows local users to ga…4.4
• CVE-2020-15408An issue was discovered in Pulse Secure Pulse Connect Secure…4.6
• CVE-2020-1541An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15411An issue was discovered in MISP 2.4.128. app/Controller/Attr…9.8