Weakness (CWE)
CWE-65: Windows Hard Link
Variant Incomplete
The product, when opening a file or directory, does not sufficiently handle when the name is associated with a hard link to a target that is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
How to prevent it (1 mitigation)
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Source: MITRE CWE-65
2 results · Clear filters · Feed
-
High 7.3CVE-2019-19231 Public exploit
An insecure file access vulnerability exists in CA Client Automation 14.0, 14.1, 14.2, and 14.3 Agent for Windows that …
-
Unscored —CVE-2019-8452 Public exploit
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clie…