CVE-2022-3592

Katalog CVE

CVSS 6.5 · Medium EPSS 2,6%

Kerentanan UNIX Symbolic Link (Symlink) Following pada samba, fedoraproject fedora. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks to files outside the 'smbd' configured share path and gain access to another restricted server's filesystem.

Rincian

Terbit di NVD

12 Januari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-61: UNIX Symbolic Link (Symlink) Following
CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

2,6% peluang dieksploitasi; lebih tinggi dari 84,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.samba.org/samba/security/CVE-2022-3592.html advisory vendor
• https://access.redhat.com/security/cve/CVE-2022-3592 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2137776 issue tracking · advisory pihak ketiga
• https://security.gentoo.org/glsa/202309-06