Sign In
Advisories

libexpat xmlwf through 2.10.0 Symlink Following via -d Output Directory

Go back
Severity
medium
Date
Affecting

  • libexpat <= 2.10.0

CWE
  • CWE-59 Improper Link Resolution Before File Access ('Link Following')
CVSS
4.1
CVSS V4 Vector
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Credit
Aziz Elbelaychy, Sebastian Pipping
Description
The xmlwf tool in libexpat through 2.10.0 contains a symlink following vulnerability because -d output mode opens files with fopen("wb"), which follows symbolic links. Local attackers with write access to the output directory can plant a symlink at the expected output name to truncate or overwrite files writable by the xmlwf user.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.
  • Vulnerability Prioritization
    Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
  • Early Warning System
    Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.
Schedule a Demo