CVE-2015-3436

2015-06-0914:59:00

CWE-59

[email protected]

web.nvd.nist.gov

zarafa collaboration platform

zcp

cve-2015-3436

symlink attack

security vulnerability

file writing vulnerability

6.2 Medium

AI Score

Confidence

Low

6.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:N/I:C/A:C

0.0004 Low

EPSS

Percentile

5.2%

JSON

provider/server/ECServer.cpp in Zarafa Collaboration Platform (ZCP) before 7.1.13 and 7.2.x before 7.2.1 allows local users to write to arbitrary files via a symlink attack on /tmp/zarafa-upgrade-lock.

CPENameOperatorVersion
zarafa:zarafa_collaboration_platformzarafa zarafa collaboration platformle7.1.12
zarafa:zarafa_collaboration_platformzarafa zarafa collaboration platformeq7.2.0

CPE	Name	Operator	Version
zarafa:zarafa_collaboration_platform	zarafa zarafa collaboration platform	le	7.1.12
zarafa:zarafa_collaboration_platform	zarafa zarafa collaboration platform	eq	7.2.0