CVE-2025-3771

Katalog CVE

CVSS 7.1 · High EPSS 0,16%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada trellix system information reporter. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

A path or symbolic link manipulation vulnerability in SIR 1.0.3 and prior versions allows an authenticated non-admin local user to overwrite system files with SIR backup files, which can potentially cause a system crash. This was achieved by adding a malicious entry to the registry under the Trellix SIR registry folder or via policy or with a junction symbolic link to files that the user would not normally have permission to acces

Rincian

Terbit di NVD

26 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://thrive.trellix.com/s/article/000014635 permissions required