CVE-2022-26488

Katalog CVE

CVSS 7.0 · High EPSS 1,4%

Kerentanan Untrusted Search Path pada python, netapp active iq unified manager +1 lainnya. Skor CVSS 3.1 7.0 (High) menurut NVD.

Deskripsi (NVD)

In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable directories to the system search path. To exploit, an administrator must have installed Python for all users and enabled PATH entries. A non-administrative user can trigger a repair that incorrectly adds user-writable paths into PATH, enabling search-path hijacking of other users and system services. This affects Python (CPython) through 3.7.12, 3.8.x through 3.8.12, 3.9.x through 3.9.10, and 3.10.x through 3.10.2.

Rincian

Terbit di NVD

10 Maret 2022

Terakhir diubah

8 Oktober 2026

Status NVD

Modified

CVSS 3.1

7.0 (High), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-426: Untrusted Search Path

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.netapp.com/advisory/ntap-20220419-0005/ advisory pihak ketiga
• https://mail.python.org/archives/list/security-announce%40python.org/thread/657Z4XULWZNIY5FRP3OWXHYKUSIH6DMN/