Weakness (CWE)
CWE-59: Improper Link Resolution Before File Access
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
How to prevent it (1 mitigation)
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Source: MITRE CWE-59
47 results · Clear filters · Feed
-
High 7.8
An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka …
KEV Mar 15, 2022 -
High 7.8
An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To …
KEV Mar 15, 2022 -
High 7.8
Windows Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install p…
KEV Mar 15, 2022 -
High 7.8
Task Scheduler Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, a…
KEV Mar 15, 2022 -
High 7.8
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard l…
KEV Mar 15, 2022 -
High 7.8
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain per…
KEV Aug 26, 2026 -
High 7.8
The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and …
KEV Feb 10, 2022