5.9
CVE-2022-38699
- EPSS 0.21%
- Published 28.09.2022 04:15:13
- Last modified 21.11.2024 07:16:57
- Source twcert@cert.org.tw
- Teams watchlist Login
- Open Login
Armoury Crate Service’s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privilege can modify the log file property to a symbolic link that points to arbitrary system file, causing the logging function to overwrite the system file and disrupt the system.
Data is provided by the National Vulnerability Database (NVD)
Asus ≫ Armoury Crate Service Version < 5.2.10.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.21% | 0.434 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| twcert@cert.org.tw | 5.9 | 0.7 | 5.2 |
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
|
CWE-59 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.