CVE detail
CVE-2019-18932 — CVE-2019-18932
Published 2020-01-21 · Modified 2026-06-17 · Vendor squid_analysis_report_generator_project · Product squid_analysis_report_generator · Source nvd
HIGH
severity
CVSS-derived band
0.0025
EPSS probability
exploitation probability, 30d
16.0%
EPSS percentile
percentile vs all CVEs
NOT LISTED
CISA KEV
known exploited catalog
Description
log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a fixed temporary directory /tmp/sarg. As the root user, sarg creates this directory or reuses an existing one in an insecure manner. An attacker can pre-create the directory, and place symlinks in it (after winning a /tmp/sarg/denied.int_unsort race condition). The outcome will be corrupted or newly created files in privileged file system locations.
Remediation
No vendor-published fix data in our corpus for this CVE. Check the references below or the vendor's PSIRT / security advisories page.
References