Is CVE-2019-3681 actively exploited?

No active exploitation of CVE-2019-3681 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2019-3681 be exploited remotely?

Yes. CVE-2019-3681 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2019-3681?

CVE-2019-3681 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2019-3681

CRITICAL

CVE-2019-3681

CWE-73Published: June 29, 2020· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that can change downloaded packages to overwrite arbitrary files. This issue affects: SUSE Linux Enterprise Module for Development Tools 15 osc versions prior to 0.169.1-3.20.1. SUSE Linux Enterprise Software Development Kit 12-SP5 osc versions prior to 0.162.1-15.9.1. SUSE Linux Enterprise Software Development Kit 12-SP4 osc versions prior to 0.162.1-15.9.1. openSUSE Leap 15.1 osc versions prior to 0.169.1-lp151.2.15.1. openSUSE Factory osc versions prior to 0.169.0 .

NVD Source

Technical Analysis

CVE-2019-3681 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.