Lucene search

MitreCVE-2021-31154

HistoryMay 27, 2021 - 1:15 p.m.

CVE-2021-31154

2021-05-2713:15:08

CWE-668

mitre

web.nvd.nist.gov

cve

2021

31154

vulnerability

symlink attack

nvd

security

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

Percentile

5.1%

JSON

pleaseedit in please before 0.4 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.

Affected configurations

Nvd

Node

pleaseedit_projectpleaseeditRange<0.4

VendorProductVersionCPE
pleaseedit_projectpleaseedit*cpe:2.3:a:pleaseedit_project:pleaseedit:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pleaseedit_project	pleaseedit	*	cpe:2.3:a:pleaseedit_project:pleaseedit::::::::

References

gitlab.com/edneville/please/-/tree/master/src/bin

www.openwall.com/lists/oss-security/2021/05/18/1

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2021-31154