CWE-59
AllowedImproper Link Resolution Before File Access ('Link Following')
Abstraction: Base · Status: Draft
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
1985 vulnerabilities reference this CWE, most recent first.
GHSA-69P6-GP5X-J269
Vulnerability from github – Published: 2024-07-25 21:31 – Updated: 2024-11-18 16:26In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the snap squashfs image (such as icons and desktop files etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained symbolic links at these paths could then cause snapd to write out the contents of the symbolic link destination into a world-readable directory. This in-turn could allow an unprivileged user to gain access to privileged information.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/snapcore/snapd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.62"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-29069"
],
"database_specific": {
"cwe_ids": [
"CWE-59",
"CWE-610"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-26T16:39:29Z",
"nvd_published_at": "2024-07-25T20:15:04Z",
"severity": "LOW"
},
"details": "In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the snap squashfs image (such as icons and desktop files etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained symbolic links at these paths could then cause snapd to write out the contents of the symbolic link destination into a world-readable directory. This in-turn could allow an unprivileged user to gain access to privileged information.",
"id": "GHSA-69p6-gp5x-j269",
"modified": "2024-11-18T16:26:55Z",
"published": "2024-07-25T21:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29069"
},
{
"type": "WEB",
"url": "https://github.com/snapcore/snapd/pull/13682"
},
{
"type": "WEB",
"url": "https://github.com/snapcore/snapd/commit/b66fee81606a1c05f965a876ccbaf44174194063"
},
{
"type": "PACKAGE",
"url": "https://github.com/snapcore/snapd"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2024-3009"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "snapd failed to properly check the destination of symbolic links when extracting a snap"
}
GHSA-6C6M-G479-H6F3
Vulnerability from github – Published: 2025-07-08 18:31 – Updated: 2025-07-08 18:31Improper link resolution before file access ('link following') in Service Fabric allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2025-21195"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-08T17:15:33Z",
"severity": "MODERATE"
},
"details": "Improper link resolution before file access (\u0027link following\u0027) in Service Fabric allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-6c6m-g479-h6f3",
"modified": "2025-07-08T18:31:43Z",
"published": "2025-07-08T18:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21195"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21195"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6C7C-85QV-WVGP
Vulnerability from github – Published: 2022-10-29 19:00 – Updated: 2022-11-01 12:00multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.
{
"affected": [],
"aliases": [
"CVE-2022-41973"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-29T18:15:00Z",
"severity": "HIGH"
},
"details": "multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.",
"id": "GHSA-6c7c-85qv-wvgp",
"modified": "2022-11-01T12:00:37Z",
"published": "2022-10-29T19:00:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41973"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1202739"
},
{
"type": "WEB",
"url": "https://github.com/opensvc/multipath-tools/releases/tag/0.9.2"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00037.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIGZM5NOOMFDCITOLQEJNNX5SCRQLQVV"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QIGZM5NOOMFDCITOLQEJNNX5SCRQLQVV"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202311-06"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5366"
},
{
"type": "WEB",
"url": "https://www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/169611/Leeloo-Multipath-Authorization-Bypass-Symlink-Attack.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2022/Dec/4"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2022/Oct/25"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/10/24/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/11/30/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6C9M-2JHW-8335
Vulnerability from github – Published: 2022-05-13 01:29 – Updated: 2022-05-13 01:29MySQL before 5.1.46 allows local users to delete the data and index files of another user's MyISAM table via a symlink attack in conjunction with the DROP TABLE command, a different vulnerability than CVE-2008-4098 and CVE-2008-7247.
{
"affected": [],
"aliases": [
"CVE-2010-1626"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-05-21T17:30:00Z",
"severity": "LOW"
},
"details": "MySQL before 5.1.46 allows local users to delete the data and index files of another user\u0027s MyISAM table via a symlink attack in conjunction with the DROP TABLE command, a different vulnerability than CVE-2008-4098 and CVE-2008-7247.",
"id": "GHSA-6c9m-2jhw-8335",
"modified": "2022-05-13T01:29:45Z",
"published": "2022-05-13T01:29:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1626"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9490"
},
{
"type": "WEB",
"url": "http://bugs.mysql.com/bug.php?id=40980"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00005.html"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1024004"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:101"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2010/05/10/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2010/05/18/4"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0442.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/40257"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-1397-1"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/1194"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6CMG-J379-64RM
Vulnerability from github – Published: 2026-01-15 00:31 – Updated: 2026-01-15 00:31An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges.
{
"affected": [],
"aliases": [
"CVE-2025-13154"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-14T23:15:55Z",
"severity": "MODERATE"
},
"details": "An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges.",
"id": "GHSA-6cmg-j379-64rm",
"modified": "2026-01-15T00:31:38Z",
"published": "2026-01-15T00:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13154"
},
{
"type": "WEB",
"url": "https://support.lenovo.com/us/en/product_security/LEN-208293"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6CX8-Q77V-F378
Vulnerability from github – Published: 2024-12-12 03:33 – Updated: 2024-12-12 03:33WmsRepair Service Elevation of Privilege Vulnerability
{
"affected": [],
"aliases": [
"CVE-2024-49107"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-12T02:04:36Z",
"severity": "HIGH"
},
"details": "WmsRepair Service Elevation of Privilege Vulnerability",
"id": "GHSA-6cx8-q77v-f378",
"modified": "2024-12-12T03:33:05Z",
"published": "2024-12-12T03:33:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49107"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49107"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6G5M-97V8-HH8J
Vulnerability from github – Published: 2022-05-14 03:01 – Updated: 2022-05-14 03:01An issue was discovered in Cinnamon 1.9.2 through 3.8.6. The cinnamon-settings-users.py GUI runs as root and allows configuration of (for example) other users' icon files in _on_face_browse_menuitem_activated and _on_face_menuitem_activated. These icon files are written to the respective user's $HOME/.face location. If an unprivileged user prepares a symlink pointing to an arbitrary location, then this location will be overwritten with the icon content.
{
"affected": [],
"aliases": [
"CVE-2018-13054"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-02T14:29:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Cinnamon 1.9.2 through 3.8.6. The cinnamon-settings-users.py GUI runs as root and allows configuration of (for example) other users\u0027 icon files in _on_face_browse_menuitem_activated and _on_face_menuitem_activated. These icon files are written to the respective user\u0027s $HOME/.face location. If an unprivileged user prepares a symlink pointing to an arbitrary location, then this location will be overwritten with the icon content.",
"id": "GHSA-6g5m-97v8-hh8j",
"modified": "2022-05-14T03:01:06Z",
"published": "2022-05-14T03:01:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13054"
},
{
"type": "WEB",
"url": "https://github.com/linuxmint/Cinnamon/pull/7683"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1083067"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00011.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6G5Q-PC77-85J9
Vulnerability from github – Published: 2022-05-17 04:46 – Updated: 2022-05-17 04:46The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.
{
"affected": [],
"aliases": [
"CVE-2013-4472"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-04-22T14:23:00Z",
"severity": "LOW"
},
"details": "The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.",
"id": "GHSA-6g5q-pc77-85j9",
"modified": "2022-05-17T04:46:05Z",
"published": "2022-05-17T04:46:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4472"
},
{
"type": "WEB",
"url": "http://osvdb.org/99064"
},
{
"type": "WEB",
"url": "http://poppler.freedesktop.org/releases.html"
},
{
"type": "WEB",
"url": "http://seclists.org/oss-sec/2013/q4/181"
},
{
"type": "WEB",
"url": "http://seclists.org/oss-sec/2013/q4/183"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6GCG-HP2X-Q54H
Vulnerability from github – Published: 2022-05-23 21:13 – Updated: 2022-05-23 21:13Impact
All unpatched versions of Argo CD starting with v0.7.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD's repo-server.
A malicious Argo CD user with write access for a repository which is (or may be) used in a directory-type Application may commit a symlink which points to an out-of-bounds file. * If the target file is a valid JSON or YAML manifest file, and the resource is allowed in the Application, the attacker can read the contents of that manifest file. (In versions <2.3.2, <2.2.8, and <2.1.14, the attacker may read the files contents even if the resource is not allowed in the Application). * If the target file is valid JSON but is not a manifest file, the attacker may read the contents of the file. * If the target file is not valid JSON or YAML, the attacker may read partial file contents (usually just the first character of the file).
Sensitive files which could be leaked include manifest files from other Applications' source repositories (potentially decrypted files, if you are using a decryption plugin) or any JSON-formatted secrets which have been mounted as files on the repo-server.
Patches
A patch for this vulnerability has been released in the following Argo CD versions:
- v2.3.4
- v2.2.9
- v2.1.15
Workarounds
- If you are using >=v2.3.0 and do not have any Jsonnet/directory-type Applications, disable the Jsonnet/directory config management tool. The config key is called
jsonnet.enablesince the same build tool is used for both Jsonnet and plain-manifest ("directory") sources.
Mitigations
- Avoid mounting JSON-formatted secrets as files on the repo-server.
- Upgrade to >=2.3.0 to significantly reduce the risk of leaking out-of-bounds manifest files. Starting with 2.3.0, repository paths are randomized, and read permissions are restricted when manifests are not being actively being generated. This makes it very difficult to craft and use a malicious symlink.
- Upgrade to >=2.3.3, >=2.2.8, or >= 2.1.14 to significantly reduce the risk of leaking the contents of (but not the existence of) out-of-bounds manifest files. These versions prevent attackers from loading manifests which are not permitted in the Project which governs the Application.
Best practices which can mitigate risk
- Limit who has push access to manifest repositories.
- Limit who is allowed to configure new source repositories.
- Limit resource kinds and destinations allowed for Projects, and restrict user access to only the necessary Projects.
Credits
This vulnerability was originally discovered as part of the Trail of Bits audit, published March 12, 2021. The behavior was left unchanged at the time.
The vulnerability was independently re-discovered by @crenshaw-dev, who contributed the patch. A security audit by Ada Logics independently followed up on the Trail of Bits report around the same time.
References
- List of types of Applications, including directory-type
- RBAC documentation, showing how to limit repository permissions
- Project documentation, showing how to limit allowable resource kinds and destinations
For more information
Open an issue in the Argo CD issue tracker or discussions Join us on Slack in channel #argo-cd
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/argoproj/argo-cd/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.15"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/argoproj/argo-cd/v2"
},
"ranges": [
{
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/argoproj/argo-cd/v2"
},
"ranges": [
{
"events": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-24904"
],
"database_specific": {
"cwe_ids": [
"CWE-59",
"CWE-61"
],
"github_reviewed": true,
"github_reviewed_at": "2022-05-23T21:13:57Z",
"nvd_published_at": "2022-05-20T14:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nAll unpatched versions of Argo CD starting with v0.7.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive files from Argo CD\u0027s repo-server.\n\nA malicious Argo CD user with write access for a repository which is (or may be) used in a directory-type Application may commit a symlink which points to an out-of-bounds file. \n* If the target file is a valid JSON or YAML manifest file, and the resource is allowed in the Application, the attacker can read the contents of that manifest file. (In versions \u003c2.3.2, \u003c2.2.8, and \u003c2.1.14, the attacker may read the files contents even if the resource is _not_ allowed in the Application). \n* If the target file is valid JSON but is _not_ a manifest file, the attacker may read the contents of the file. \n* If the target file is not valid JSON or YAML, the attacker may read partial file contents (usually just the first character of the file).\n\nSensitive files which could be leaked include manifest files from other Applications\u0027 source repositories (potentially decrypted files, if you are using a decryption plugin) or any JSON-formatted secrets which have been mounted as files on the repo-server.\n\n### Patches\n\nA patch for this vulnerability has been released in the following Argo CD versions:\n\n* v2.3.4\n* v2.2.9\n* v2.1.15\n\n### Workarounds\n\n* If you are using \u003e=v2.3.0 and do not have any Jsonnet/directory-type Applications, [disable the Jsonnet/directory config management tool](https://argo-cd.readthedocs.io/en/stable/user-guide/tool_detection/#disable-built-in-tools). The config key is called `jsonnet.enable` since the same build tool is used for both Jsonnet and plain-manifest (\"directory\") sources.\n\n#### Mitigations\n\n* Avoid mounting JSON-formatted secrets as files on the repo-server.\n* Upgrade to \u003e=2.3.0 to significantly reduce the risk of leaking out-of-bounds manifest files. Starting with 2.3.0, repository paths are randomized, and read permissions are restricted when manifests are not being actively being generated. This makes it very difficult to craft and use a malicious symlink.\n* Upgrade to \u003e=2.3.3, \u003e=2.2.8, or \u003e= 2.1.14 to significantly reduce the risk of leaking the contents of (but not the existence of) out-of-bounds manifest files. These versions prevent attackers from loading manifests which are not permitted in the Project which governs the Application. \n\n#### Best practices which can mitigate risk\n\n* Limit who has push access to manifest repositories.\n* Limit who is allowed to configure new source repositories.\n* Limit resource kinds and destinations allowed for Projects, and restrict user access to only the necessary Projects.\n\n### Credits\n\nThis vulnerability was originally discovered as part of the Trail of Bits audit, published March 12, 2021. The behavior was left unchanged at the time.\n\nThe vulnerability was independently re-discovered by @crenshaw-dev, who contributed the patch. A security audit by Ada Logics independently followed up on the Trail of Bits report around the same time.\n\n### References\n\n* List of [types of Applications](https://argo-cd.readthedocs.io/en/stable/user-guide/application_sources/), including directory-type\n* [RBAC documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/), showing how to limit repository permissions\n* [Project documentation](https://argo-cd.readthedocs.io/en/stable/user-guide/projects/), showing how to limit allowable resource kinds and destinations \n\n### For more information\nOpen an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)\nJoin us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd\n",
"id": "GHSA-6gcg-hp2x-q54h",
"modified": "2022-05-23T21:13:57Z",
"published": "2022-05-23T21:13:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-6gcg-hp2x-q54h"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24904"
},
{
"type": "WEB",
"url": "https://github.com/argoproj/argo-cd/commit/5e767a4b9e30983330c0fdec322192281a90eb84"
},
{
"type": "WEB",
"url": "https://github.com/argoproj/argo-cd/commit/7357cfdb58a560de70a0538c6e3bef6fe39505ea"
},
{
"type": "WEB",
"url": "https://github.com/argoproj/argo-cd/commit/d36d95dc9f71ec61c1a93794f81ece6d61a0d943"
},
{
"type": "WEB",
"url": "https://github.com/argoproj/argo-cd/releases/tag/v2.1.15"
},
{
"type": "WEB",
"url": "https://github.com/argoproj/argo-cd/releases/tag/v2.2.9"
},
{
"type": "WEB",
"url": "https://github.com/argoproj/argo-cd/releases/tag/v2.3.4"
},
{
"type": "PACKAGE",
"url": "github.com/argoproj/argo-cd"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-server"
}
GHSA-6H65-6827-8QP2
Vulnerability from github – Published: 2022-05-17 02:10 – Updated: 2022-05-17 02:10Open redirect vulnerability in wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the backto parameter.
{
"affected": [],
"aliases": [
"CVE-2008-6762"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-04-28T16:30:00Z",
"severity": "MODERATE"
},
"details": "Open redirect vulnerability in wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the backto parameter.",
"id": "GHSA-6h65-6827-8qp2",
"modified": "2022-05-17T02:10:13Z",
"published": "2022-05-17T02:10:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6762"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50382"
},
{
"type": "WEB",
"url": "http://archives.neohapsis.com/archives/bugtraq/2008-12/0226.html"
},
{
"type": "WEB",
"url": "http://osvdb.org/52213"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2009/dsa-1871"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation MIT-48.1
Strategy: Separation of Privilege
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CAPEC-132: Symlink Attack
An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.
CAPEC-17: Using Malicious Files
An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.