CVE-2024-5742

Katalog CVE

CVSS 6.7 · Medium EPSS 0,34%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada gnu nano, redhat enterprise linux. Skor CVSS 3.1 6.7 (Medium) menurut redhat.com.

Deskripsi (NVD)

A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink.

Rincian

Terbit di NVD

12 Juni 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.7 (Medium), sumber redhat.com
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2024-5742 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2278574 issue tracking · advisory vendor
• https://access.redhat.com/errata/RHSA-2024:6986
• https://access.redhat.com/errata/RHSA-2024:9430
• https://lists.debian.org/debian-lts-announce/2024/06/msg00006.html