cve.bz

CWE-59: Improper Link Resolution Before File Access (Link Following), page 19

Filter

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

What the weakness is: CWE-59 at MITRE

Ask an AI about CWE-59

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-59: Improper Link Resolution Before File Access and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/59.html and https://cve.bz/cve/cwe/59?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.1CVE-2023-21760EPSS 0.5%

    Windows Print Spooler Elevation of Privilege Vulnerability

  2. 6.3CVE-2023-21725EPSS 0.4%

    Windows Malicious Software Removal Tool Elevation of Privilege Vulnerability

  3. 7.8CVE-2023-21678EPSS 0.6%

    Windows Print Spooler Elevation of Privilege Vulnerability

  4. 7.0CVE-2023-21542EPSS 0.3%

    Windows Installer Elevation of Privilege Vulnerability

  5. 4.3CVE-2022-38482EPSS 0.6%

    A link-manipulation issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP4.

  6. 8.1CVE-2022-36943EPSS 0.9%

    SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when opening a malicious ZIP containing a syml…

  7. 6.5CVE-2021-4287EPSS 2.1%

    A vulnerability, which was classified as problematic, was found in ReFirm Labs binwalk up to 2.3.2. Affected is an unknown function of the file src/binwalk/modules/extractor.py of the component Archive Extraction Handler. The manipulation …

  8. 7.8CVE-2022-45798EPSS 0.3%

    A link following vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Service could allow a local attacker to escalate privileges by creating a symbolic link and abusing the service to …

  9. 8.8CVE-2022-45412EPSS 0.8%

    When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer. <br>*This bug only affects Thunderbird on Unix-b…

  10. 7.8CVE-2022-4563EPSS 0.3%

    A vulnerability was found in Freedom of the Press SecureDrop. It has been rated as critical. Affected by this issue is some unknown functionality of the file gpg-agent.conf. The manipulation leads to symlink following. Local access is requ…

  11. 5.3CVE-2022-4122EPSS 0.9%

    A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure.

  12. 7.0CVE-2009-1143EPSS 0.3%

    An issue was discovered in open-vm-tools 2009.03.18-154848. Local users can bypass intended access restrictions on mounting shares via a symlink attack that leverages a realpath race condition in mount.vmhgfs (aka hgfsmounter).

  13. 6.7CVE-2009-1142EPSS 0.3%

    An issue was discovered in open-vm-tools 2009.03.18-154848. Local users can gain privileges via a symlink attack on /tmp files if vmware-user-suid-wrapper is setuid root and the ChmodChownDirectory function is enabled.

  14. 7.8CVE-2022-44747EPSS 0.2%

    Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.

  15. 7.8CVE-2022-32905EPSS 0.3%

    This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13. Processing a maliciously crafted DMG file may lead to arbitrary code execution with system privileges.

  16. 7.8CVE-2022-41973EPSS 0.7%

    multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink hand…

  17. 7.8CVE-2022-31256EPSS 0.3%

    A Improper Link Resolution Before File Access ('Link Following') vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: SUSE openS…

  18. 5.5CVE-2022-39253EPSS 1.5%

    Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performi…

  19. 7.5CVE-2022-42725EPSS 1.7%

    Warpinator through 1.2.14 allows access outside of an intended directory, as demonstrated by symbolic directory links.

  20. 7.8CVE-2022-40710EPSS 0.2%

    A link following vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain th…

  21. 5.9CVE-2022-38699EPSS 0.3%

    Armoury Crate Service’s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privilege can modify the log file property to a symbolic link that points to arbitrary …

  22. 7.3CVE-2022-40143EPSS 0.3%

    A link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service servers could allow a local attacker to abuse an insecure directory that could allow a low-privileged user to run arbit…

  23. 7.8CVE-2022-34893EPSS 0.3%

    Trend Micro Security 2022 (consumer) has a link following vulnerability where an attacker with lower privileges could manipulate a mountpoint which could lead to escalation of privilege on an affected machine.

  24. 5.8CVE-2022-39215EPSS 1.0%

    Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when `readDir` is called recursively, it was possible to display directory listings outside of the defined `fs` scope. This require…

  25. 8.1CVE-2022-36113EPSS 1.2%

    Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the ~/.cargo folder on disk, making it available to the Rust projects it builds. To record when an extraction is…

  26. 5.5CVE-2022-0029EPSS 0.2%

    An improper link resolution vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local attacker to read files on the system with elevated privileges when generating a tech support file.

  27. 4.4CVE-2022-26456EPSS 0.1%

    In vow, there is a possible information disclosure due to a symbolic link following. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06…

  28. 5.5CVE-2022-2898EPSS 0.2%

    Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow a denial-of-service condition.

  29. 7.8CVE-2022-2897EPSS 0.3%

    Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow privilege escalation..

  30. 6.7CVE-2021-35939EPSS 0.5%

    It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentiall…

  31. 6.7CVE-2021-35938EPSS 0.5%

    A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security…

  32. 6.4CVE-2021-35937EPSS 0.3%

    A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threa…

  33. 9.8CVE-2022-34960EPSS 1.5%

    The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links, which resolve to locations on the host device. This allows the attacker to mount any arbitrary file to any location o…

  34. 7.8CVE-2021-31566EPSS 0.4%

    An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who wo…

  35. 7.8CVE-2021-23177EPSS 0.4%

    An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when tryin…

  36. 7.8CVE-2022-36336EPSS 0.6%

    A link following vulnerability in the scanning function of Trend Micro Apex One and Worry-Free Business Security agents could allow a local attacker to escalate privileges on affected installations. The resolution for this issue has been d…

  37. 5.5CVE-2022-35631EPSS 0.2%

    On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velociraptor client overwrite the other file. This issue was resolved in Velociraptor 0.…

  38. 7.8CVE-2022-31250EPSS 0.3%

    A UNIX Symbolic Link (Symlink) Following vulnerability in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root. This issue affects: openSUSE Tumbleweed keylime versions prior to 6.4.2-1.1.

  39. 7.1CVE-2022-32450EPSS 0.5%

    AnyDesk 7.0.9 allows a local user to gain SYSTEM privileges via a symbolic link because the user can write to their own %APPDATA% folder (used for ad.trace and chat) but the product runs as SYSTEM when writing chat-room data there.

  40. 6.7CVE-2022-21770EPSS 0.1%

    In sound driver, there is a possible information disclosure due to symlink following. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS0…

  41. 7.8CVE-2022-2145EPSS 0.3%

    Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData folder. During installation of the WARP client, it was possible to escalate privileges and overwrite SYSTEM protected files.

  42. 4.3CVE-2022-31036EPSS 0.9%

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML …

  43. 6.7CVE-2021-42056EPSS 1.0%

    Thales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a local attacker, through a symlink attack, to overwrite arbitrary files, and potentially achieve arbitr…

  44. 7.8CVE-2022-34008EPSS 0.5%

    Comodo Antivirus 12.2.2.8012 has a quarantine flaw that allows privilege escalation. To escalate privilege, a low-privileged attacker can use an NTFS directory junction to restore a malicious DLL from quarantine into the System32 folder.

  45. 7.5CVE-2022-25856EPSS 1.9%

    The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the (g *GitArtifactReader).Read() API in git.go. This could allow arbitrary file reads if the GitArtifactReader is provided…

  46. 7.8CVE-2022-28225EPSS 0.5%

    Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.684 allows a local, low privileged, attacker to execute arbitary code with the SYSTEM privileges through manipulating symlinks to installation file during Yandex B…

  47. 7.8CVE-2021-25261EPSS 0.5%

    Local privilege vulnerability in Yandex Browser for Windows prior to 22.5.0.862 allows a local, low privileged, attacker to execute arbitary code with the SYSTEM privileges through manipulating symlinks to installation file during Yandex B…

  48. 7.8CVE-2022-31219EPSS 0.3%

    Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file …

  49. 7.8CVE-2022-31218EPSS 0.3%

    Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file …

  50. 7.8CVE-2022-31217EPSS 0.3%

    Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file …