CVE-2022-38699

Katalog CVE

CVSS 5.9 · Medium EPSS 0,33%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada asus armoury crate service. Skor CVSS 3.1 5.9 (Medium) menurut cert.org.tw.

Deskripsi (NVD)

Armoury Crate Service’s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privilege can modify the log file property to a symbolic link that points to arbitrary system file, causing the logging function to overwrite the system file and disrupt the system.

Rincian

Terbit di NVD

28 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber cert.org.tw
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.twcert.org.tw/tw/cp-132-6522-4eacb-1.html advisory pihak ketiga