Weakness (CWE)
CWE-59: Improper Link Resolution Before File Access
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
How to prevent it (1 mitigation)
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Source: MITRE CWE-59
406 results · Clear filters · Feed
-
Medium 5.9
A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15…
-
Medium 4.9
Arbitrary file read via symlinks in Ghost
Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host oper…
-
Medium 6.5
imapsync through 2.229 uses predictable paths under /tmp and /var/tmp in its default mode of operation. Both of these a…
-
Medium 6.3
Docker Desktop for Windows before 4.6 allows attackers to overwrite any file through the windowscontainers/start docker…
-
Medium 6.7
NTFS Junction
An NTFS Junction condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.8.0.31. Attackers may write files to arbitrary locations via a local attack vector. This allows attackers to assume the privileges of the process, and they m…
-
Medium 6.8
Junos OS: NFX Series: 'set system ports console insecure' allows root password recovery
An Improper Link Resolution Before File Access vulnerability in console port access of Juniper Networks Junos OS on NFX Series allows an attacker to bypass console access controls. When "set system ports console insecure" is enabled, root login is disallowed …
-
Medium 5.9CVE-2022-43293 Public exploit
Wacom Driver 6.3.46-1 for Windows was discovered to contain an arbitrary file write vulnerability via the component \Wa…
-
Medium 6.7
Dell PowerScale OneFS version 9.5.0.0 contains improper link resolution before file access vulnerability in isi_gather_…
-
Medium 6.1
AppArmor bypass with symlinked /proc in runc
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version…
-
Medium 5.5
McAfee Total Protection prior to 16.0.50 allows attackers to elevate user privileges due to Improper Link Resolution vi…
-
Medium 6.3
In Eternal Terminal 6.2.1, TelemetryService uses fixed paths in /tmp. For example, a local attacker can create /tmp/.se…
-
Medium 5.6
Visual Studio Denial of Service Vulnerability
Visual Studio Denial of Service Vulnerability
-
Medium 5.5CVE-2023-22490 Public exploit
Git vulnerable to local clone-based data exfiltration with non-local transports
Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local…
-
Medium 5.0
.NET Framework Denial of Service Vulnerability
.NET Framework Denial of Service Vulnerability
-
Medium 5.0
NVIDIA GeForce Experience contains a vulnerability in the NVContainer component, where a user without administrator pri…
-
Medium 4.4
A vulnerability in the CLI of Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to…
-
Medium 4.4
A vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0, which processes symb…
-
Medium 6.3
Windows Malicious Software Removal Tool Elevation of Privilege Vulnerability
Windows Malicious Software Removal Tool Elevation of Privilege Vulnerability
-
Medium 4.3
A link-manipulation issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP4.
-
Medium 5.0
ReFirm Labs binwalk Archive Extraction extractor.py symlink
A vulnerability, which was classified as problematic, was found in ReFirm Labs binwalk up to 2.3.2. Affected is an unknown function of the file src/binwalk/modules/extractor.py of the component Archive Extraction Handler. The manipulation leads to symlink fol…
-
Medium 5.3
Buildah (as part of Podman) vulnerable to Link Following
A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure.
-
Medium 6.7
An issue was discovered in open-vm-tools 2009.03.18-154848. Local users can gain privileges via a symlink attack on /tm…
-
Medium 5.9
ASUS Armoury Crate Service - Arbitrary File Creation via Elevation of Privilege Flaw
Armoury Crate Service’s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privilege can modify the log file property to a symbolic link that points to arbitrary system file, causing…
-
Medium 5.5
Cortex XDR Agent: Improper Link Resolution Vulnerability When Generating a Tech Support File
An improper link resolution vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local attacker to read files on the system with elevated privileges when generating a tech support file.
-
Medium 4.6
Extracting malicious crates can corrupt arbitrary files
Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the ~/.cargo folder on disk, making it available to the Rust projects it builds. To record when an extraction is successful, Cargo w…
-
Medium 6.1
Measuresoft ScadaPro Server and Client Link Following
Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow a denial-of-service condition.
-
Medium 5.8
Cloudlfare WARP Arbitrary File Overwrite
Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData folder. During installation of the WARP client, it was possible to escalate privileges and overwrite SYSTEM protected files.
-
Medium 4.3
Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD's…
-
Medium 4.3
Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.7.0 and prior to versions 2.1.15m 2.2.9, and 2.3.4 is vulnerable to a symlink following bug allowing a malicious user with repository write access to lea…
-
Medium 6.5
Arbitrary file read
An improper link resolution before file access ('Link Following') vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, and QTS. If exploited, this vulnerability allows remote attackers to traverse the file system to unintended l…
-
Medium 6.5
Improper Link Resolution Before File Access in Jenkins Pipeline: Shared Groovy Libraries Plugin
Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step, allowing attackers able to configure Pipelines to re…
-
Medium 6.5
Improper Link Resolution Before File Access in Jenkins Pipeline: Groovy Plugin
Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading the script file (typically Jenkinsfile) for Pipelines, allowing attackers able to configur…
-
Medium 6.5
Link Following in Jenkins Pipeline Multibranch Plugin
Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading files using the readTrusted step, allowing attackers able to configure Pipelines permi…
-
Medium 6.1
Cortex XDR Agent: Local Arbitrary File Deletion Vulnerability
An improper link resolution before file access vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables a local user to delete arbitrary system files and impact the system integrity or cause a denial of service conditi…
-
Medium 5.5
Windows Installer Elevation of Privilege Vulnerability
Windows Installer Elevation of Privilege Vulnerability
KEV Mar 3, 2022 -
Medium 6.1
Improper Link Resolution Before File Access in Bitdefender GravityZone (VA-9921)
Improper Link Resolution Before File Access ('Link Following') vulnerability in the EPAG component of Bitdefender Endpoint Security Tools for Windows allows a local attacker to cause a denial of service. This issue affects: Bitdefender GravityZone version 7.1…
-
Medium 5.2
apport process_report() arbitrary file write
It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks.
-
Medium 6.8
python-postorius: postorius-permissions.sh used during %post allows local privilege escalation from postorius user to root
A UNIX Symbolic Link (Symlink) Following vulnerability in python-postorius of openSUSE Leap 15.2, Factory allows local attackers to escalate from users postorius or postorius-admin to root. This issue affects: openSUSE Leap 15.2 python-postorius version 1.3.2…
-
Medium 6.1
This vulnerability allows local attackers to delete arbitrary directories on affected installations of Avast Premium Se…
-
Medium 6.3
There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar…