CVE-2022-3592

A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks to files outside the 'smbd' configured share path and gain access to another restricted server's filesystem.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2022-3592	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2137776	Issue Tracking Third Party Advisory
https://security.gentoo.org/glsa/202309-06
https://www.samba.org/samba/security/CVE-2022-3592.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:fedoraproject:fedora:36:::::::*
	cpe:2.3:o:fedoraproject:fedora:37:::::::*

History

No history.

Information

Published : 2023-01-12 15:15

Updated : 2023-09-17 09:15

NVD link : CVE-2022-3592

Mitre link : CVE-2022-3592

CVE.ORG link : CVE-2022-3592

JSON object : View

Products Affected

samba

samba

fedoraproject

fedora

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

CWE-61

UNIX Symbolic Link (Symlink) Following

{"id": "CVE-2022-3592", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2023-01-12T15:15:10.273", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2022-3592", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2137776", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://security.gentoo.org/glsa/202309-06", "source": "secalert@redhat.com"}, {"url": "https://www.samba.org/samba/security/CVE-2022-3592.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-59"}]}, {"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-61"}]}], "descriptions": [{"lang": "en", "value": "A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks to files outside the 'smbd' configured share path and gain access to another restricted server's filesystem."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad de seguimiento de enlaces simb\u00f3licos en Samba, donde un usuario puede crear un enlace simb\u00f3lico que haga que 'smbd' escape de la ruta de recurso compartido configurada. Este fallo permite a un usuario remoto con acceso a la parte exportada del sistema de archivos bajo un recurso compartido a trav\u00e9s de extensiones SMB1 unix o NFS crear enlaces simb\u00f3licos a archivos fuera de la ruta de recurso compartido configurada por 'smbd' y obtener acceso al sistema de archivos de otro servidor restringido."}], "lastModified": "2023-09-17T09:15:11.483", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9CD07976-E402-4282-B52A-AC9A6FD27FB5", "versionEndExcluding": "4.17.2", "versionStartIncluding": "4.17.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD"}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}

6.5 /10