7.1

CVE-2021-41057

In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions.

Data is provided by the National Vulnerability Database (NVD)
Wibu ≫ Codemeter Runtime Version < 7.30a
   Microsoft ≫ Windows Version-
Siemens ≫ Pss Cape Version14
Siemens ≫ Pss E Version >= 34.0.0 < 34.9.1
Siemens ≫ Pss E Version >= 35.0.0 < 35.3.2
Siemens ≫ Pss Odms Version < 12.2.6.1
Siemens ≫ Sicam 230 Version < 8.0
Siemens ≫ Simatic Information Server Version2019 Update-
Siemens ≫ Simatic Information Server Version2019 Updatesp1
Siemens ≫ Simatic Process Historian Version <= 2019
Siemens ≫ Simatic Wincc Oa Version <= 3.18
Siemens ≫ Simit Version <= 10.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.17% 0.384
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.1 1.8 5.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
nvd@nist.gov 3.6 3.9 4.9
AV:L/AC:L/Au:N/C:N/I:P/A:P
CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.