CVE-2012-4454

2012-10-1018:55:04

CWE-264

[email protected]

web.nvd.nist.gov

CVSS2

2.9

Attack Vector

ADJACENT_NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:A/AC:M/Au:N/C:N/I:P/A:N

AI Score

6.2

Confidence

High

EPSS

Percentile

10.1%

JSON

openCryptoki before 2.4.1, when using spinlocks, allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) .pkapi_xpk or (2) .pkcs11spinloc file in /tmp.

Affected configurations

Nvd

Node

opencryptoki_projectopencryptokiRange≤2.4

opencryptoki_projectopencryptokiMatch2.2.3

opencryptoki_projectopencryptokiMatch2.2.4

opencryptoki_projectopencryptokiMatch2.2.4.1

opencryptoki_projectopencryptokiMatch2.2.5

opencryptoki_projectopencryptokiMatch2.2.6

opencryptoki_projectopencryptokiMatch2.2.7

opencryptoki_projectopencryptokiMatch2.2.8

opencryptoki_projectopencryptokiMatch2.3.0

opencryptoki_projectopencryptokiMatch2.3.1

opencryptoki_projectopencryptokiMatch2.3.2

opencryptoki_projectopencryptokiMatch2.3.3

VendorProductVersionCPE
opencryptoki_projectopencryptoki*cpe:2.3:a:opencryptoki_project:opencryptoki:*:*:*:*:*:*:*:*
opencryptoki_projectopencryptoki2.2.3cpe:2.3:a:opencryptoki_project:opencryptoki:2.2.3:*:*:*:*:*:*:*
opencryptoki_projectopencryptoki2.2.4cpe:2.3:a:opencryptoki_project:opencryptoki:2.2.4:*:*:*:*:*:*:*
opencryptoki_projectopencryptoki2.2.4.1cpe:2.3:a:opencryptoki_project:opencryptoki:2.2.4.1:*:*:*:*:*:*:*
opencryptoki_projectopencryptoki2.2.5cpe:2.3:a:opencryptoki_project:opencryptoki:2.2.5:*:*:*:*:*:*:*
opencryptoki_projectopencryptoki2.2.6cpe:2.3:a:opencryptoki_project:opencryptoki:2.2.6:*:*:*:*:*:*:*
opencryptoki_projectopencryptoki2.2.7cpe:2.3:a:opencryptoki_project:opencryptoki:2.2.7:*:*:*:*:*:*:*
opencryptoki_projectopencryptoki2.2.8cpe:2.3:a:opencryptoki_project:opencryptoki:2.2.8:*:*:*:*:*:*:*
opencryptoki_projectopencryptoki2.3.0cpe:2.3:a:opencryptoki_project:opencryptoki:2.3.0:*:*:*:*:*:*:*
opencryptoki_projectopencryptoki2.3.1cpe:2.3:a:opencryptoki_project:opencryptoki:2.3.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
opencryptoki_project	opencryptoki	*	cpe:2.3:a:opencryptoki_project:opencryptoki::::::::
opencryptoki_project	opencryptoki	2.2.3	cpe:2.3:a:opencryptoki_project:opencryptoki:2.2.3:::::::*
opencryptoki_project	opencryptoki	2.2.4	cpe:2.3:a:opencryptoki_project:opencryptoki:2.2.4:::::::*
opencryptoki_project	opencryptoki	2.2.4.1	cpe:2.3:a:opencryptoki_project:opencryptoki:2.2.4.1:::::::*
opencryptoki_project	opencryptoki	2.2.5	cpe:2.3:a:opencryptoki_project:opencryptoki:2.2.5:::::::*
opencryptoki_project	opencryptoki	2.2.6	cpe:2.3:a:opencryptoki_project:opencryptoki:2.2.6:::::::*
opencryptoki_project	opencryptoki	2.2.7	cpe:2.3:a:opencryptoki_project:opencryptoki:2.2.7:::::::*
opencryptoki_project	opencryptoki	2.2.8	cpe:2.3:a:opencryptoki_project:opencryptoki:2.2.8:::::::*
opencryptoki_project	opencryptoki	2.3.0	cpe:2.3:a:opencryptoki_project:opencryptoki:2.3.0:::::::*
opencryptoki_project	opencryptoki	2.3.1	cpe:2.3:a:opencryptoki_project:opencryptoki:2.3.1:::::::*