CVE-2011-2185

2011-07-2702:55:01

CWE-59

[email protected]

web.nvd.nist.gov

cve

2011

2185

fabric

file overwrite

symlink attack

nvd

4.4 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

6.3 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

Fabric before 1.1.0 allows local users to overwrite arbitrary files via a symlink attack on (1) a /tmp/fab.*.tar file or (2) certain other files in the top level of /tmp/.

Affected configurations

NVD

Node

fabfilefabricRange≤1.0.2

fabfilefabricMatch0.9

fabfilefabricMatch0.9.1

fabfilefabricMatch0.9.2

fabfilefabricMatch0.9.3

fabfilefabricMatch0.9.4

fabfilefabricMatch0.9.5

fabfilefabricMatch0.9.6

fabfilefabricMatch0.9.7

fabfilefabricMatch1.0.0

fabfilefabricMatch1.0.1

CPENameOperatorVersion
fabfile:fabricfabfile fabricle1.0.2
fabfile:fabricfabfile fabriceq0.9
fabfile:fabricfabfile fabriceq0.9.1
fabfile:fabricfabfile fabriceq0.9.2
fabfile:fabricfabfile fabriceq0.9.3
fabfile:fabricfabfile fabriceq0.9.4
fabfile:fabricfabfile fabriceq0.9.5
fabfile:fabricfabfile fabriceq0.9.6
fabfile:fabricfabfile fabriceq0.9.7
fabfile:fabricfabfile fabriceq1.0.0

CPE	Name	Operator	Version
fabfile:fabric	fabfile fabric	le	1.0.2
fabfile:fabric	fabfile fabric	eq	0.9
fabfile:fabric	fabfile fabric	eq	0.9.1
fabfile:fabric	fabfile fabric	eq	0.9.2
fabfile:fabric	fabfile fabric	eq	0.9.3
fabfile:fabric	fabfile fabric	eq	0.9.4
fabfile:fabric	fabfile fabric	eq	0.9.5
fabfile:fabric	fabfile fabric	eq	0.9.6
fabfile:fabric	fabfile fabric	eq	0.9.7
fabfile:fabric	fabfile fabric	eq	1.0.0