CVE-2022-3592

2023-01-1200:00:00

ubuntu.com

samba

symlink vulnerability

unauthorized access

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.003

Percentile

66.1%

JSON

A symlink following vulnerability was found in Samba, where a user can
create a symbolic link that will make ‘smbd’ escape the configured share
path. This flaw allows a remote user with access to the exported part of
the file system under a share via SMB1 unix extensions or NFS to create
symlinks to files outside the ‘smbd’ configured share path and gain access
to another restricted server’s filesystem.