9.3
CVE-2019-10220
- EPSS 0.74%
- Veröffentlicht 27.11.2019 16:15:11
- Zuletzt bearbeitet 21.11.2024 04:18:41
- Quelle secalert@redhat.com
- CVE-Watchlists
- Unerledigt
LoginLinux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 2.6.12 < 3.16.81
Linux ≫ Linux Kernel Version >= 3.17 < 4.4.208
Linux ≫ Linux Kernel Version >= 4.5 < 4.9.208
Linux ≫ Linux Kernel Version >= 4.10 < 4.14.162
Linux ≫ Linux Kernel Version >= 4.15 < 4.19.93
Linux ≫ Linux Kernel Version >= 4.20 < 5.3.8
Debian ≫ Debian Linux Version8.0
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version19.04
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.74% | 0.723 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 9.3 | 8.6 | 10 |
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
| secalert@redhat.com | 8 | 2.1 | 5.9 |
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
|
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.