vulnwire
7.5high

CVE-2002-2323

Sun PC NetLink 1.0 through 1.2 does not properly set the access control list (ACL) for files and directories that use symbolic links and ha…

Published 23 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
2.2%
percentile 83%
Public exploits
0
none known

Sun PC NetLink 1.0 through 1.2 does not properly set the access control list (ACL) for files and directories that use symbolic links and have been restored from backup, which could allow local or remote attackers to bypass intended access restrictions.

Exploit prediction (EPSS)

2.21% probability of exploitation in the next 30 days, higher than 83% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access
  • CWE-281 Improper Preservation of Permissions

References

  • sunsolve.sun.com /search/document.do?assetkey=1-26-27807-1 · vendor-advisory, x_refsource_SUNALERT, x_transferred
  • iss.net /security_center/static/9665.php · vdb-entry, x_refsource_XF, x_transferred
  • securityfocus.com /bid/5281 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.