6.6

CVE-2024-36340

A  junction point vulnerability within AMD uProf can allow a local low-privileged attacker to create junction points, potentially resulting in arbitrary file deletion or disclosure.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Amd ≫ Uprof SwPlatformwindows Version < 5.0.1174
Amd ≫ Uprof SwPlatformfreebsd Version < 5.0.1223
Amd ≫ Uprof SwPlatformlinux Version < 5.0.1479
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.01% 0.013
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
psirt@amd.com 6.6 1.3 5.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CWE-1386 Insecure Operation on Windows Junction / Mount Point

The product opens a file or directory, but it does not properly prevent the name from being associated with a junction or mount point to a destination that is outside of the intended control sphere.