CVE-2022-26526

Katalog CVE

CVSS 7.8 · High EPSS 0,33%

Kerentanan Incorrect Permission Assignment for Critical Resource pada anaconda3, miniconda3. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Anaconda Anaconda3 (Anaconda Distribution) through 2021.11.0.0 and Miniconda3 through 4.11.0.0 can create a world-writable directory under %PROGRAMDATA% and place that directory into the system PATH environment variable. Thus, for example, local users can gain privileges by placing a Trojan horse file into that directory. (This problem can only happen in a non-default installation. The person who installs the product must specify that it is being installed for all users. Also, the person who installs the product must specify that the system PATH should be changed.

Rincian

Terbit di NVD

17 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.conda.io/en/latest/miniconda.html product · advisory vendor
• https://repo.anaconda.com/miniconda/ advisory vendor
• https://github.com/continuumio/anaconda-issues/issues issue tracking · advisory pihak ketiga
• https://improsec.com/tech-blog/privilege-escalation-vulnerability-in-anaconda3-and-miniconda3 exploit · advisory pihak ketiga