CVE-2014-5260

2014-08-1604:39:55

CWE-59

[email protected]

web.nvd.nist.gov

xml-dt

security vulnerability

symlink attack

nvd

cve-2014-5260

6.3 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:N/I:C/A:C

6.3 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

The (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite arbitrary files via a symlink attack on a /tmp/xml##### temporary file.

Affected configurations

NVD

Node

xml-dt_projectxml-dtRange≤0.63

xml-dt_projectxml-dtMatch0.60

xml-dt_projectxml-dtMatch0.61

xml-dt_projectxml-dtMatch0.62

CPENameOperatorVersion
xml-dt_project:xml-dtxml-dt project xml-dtle0.63
xml-dt_project:xml-dtxml-dt project xml-dteq0.60
xml-dt_project:xml-dtxml-dt project xml-dteq0.61
xml-dt_project:xml-dtxml-dt project xml-dteq0.62

CPE	Name	Operator	Version
xml-dt_project:xml-dt	xml-dt project xml-dt	le	0.63
xml-dt_project:xml-dt	xml-dt project xml-dt	eq	0.60
xml-dt_project:xml-dt	xml-dt project xml-dt	eq	0.61
xml-dt_project:xml-dt	xml-dt project xml-dt	eq	0.62