CWE-59
Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVE-2023-38175 (GCVE-0-2023-38175)
Vulnerability from cvelistv5 – Published: 2023-08-08 17:08 – Updated: 2025-02-27 21:07
VLAI
Title
Microsoft Windows Defender Elevation of Privilege Vulnerability
Summary
Microsoft Windows Defender Elevation of Privilege Vulnerability
Severity
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Windows Defender Antimalware Platform |
Affected:
4.0.0.0 , < 1.1.23060.3001
(custom)
|
Date Public
2023-08-08 07:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T17:30:14.078Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Microsoft Windows Defender Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38175"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-38175",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-26T21:53:48.670730Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-27T21:07:35.302Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"Unknown"
],
"product": "Windows Defender Antimalware Platform",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "1.1.23060.3001",
"status": "affected",
"version": "4.0.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:windows_defender:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.23060.3001",
"versionStartIncluding": "4.0.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2023-08-08T07:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Windows Defender Elevation of Privilege Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-01T01:59:00.388Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Windows Defender Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38175"
}
],
"title": "Microsoft Windows Defender Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2023-38175",
"datePublished": "2023-08-08T17:08:42.860Z",
"dateReserved": "2023-07-12T23:41:45.863Z",
"dateUpdated": "2025-02-27T21:07:35.302Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-41971 (GCVE-0-2023-41971)
Vulnerability from cvelistv5 – Published: 2024-05-02 13:11 – Updated: 2024-08-06 17:51
VLAI
Title
Windows ZCC Upgrade DoS And Privilege Escalation Through RPC Control
Summary
An Improper Link Resolution Before File Access ('Link Following') vulnerability in Zscaler Client Connector on Windows allows a system file to be overwritten.This issue affects Client Connector on Windows: before 3.7.
Severity
5.3 (Medium)
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zscaler | Client Connector |
Affected:
0 , < 3.7
(custom)
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:09:49.420Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021??applicable_category=windows\u0026applicable_version=3.7"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:zscaler:client_connector:*:*:*:*:*:windows:*:*"
],
"defaultStatus": "unaffected",
"product": "client_connector",
"vendor": "zscaler",
"versions": [
{
"lessThan": "3.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41971",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-02T17:15:44.552151Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-06T17:51:01.988Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Client Connector",
"vendor": "Zscaler",
"versions": [
{
"lessThan": "3.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "LMCO Red Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An Improper Link Resolution Before File Access (\u0027Link Following\u0027) vulnerability in Zscaler Client Connector on Windows allows a system file to be overwritten.\u003cp\u003eThis issue affects Client Connector on Windows: before 3.7.\u003c/p\u003e"
}
],
"value": "An Improper Link Resolution Before File Access (\u0027Link Following\u0027) vulnerability in Zscaler Client Connector on Windows allows a system file to be overwritten.This issue affects Client Connector on Windows: before 3.7.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-73",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-73 User-Controlled Filename"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-02T13:11:07.860Z",
"orgId": "73c6f63b-efac-410d-a0a9-569700f85a04",
"shortName": "Zscaler"
},
"references": [
{
"url": "https://help.zscaler.com/zscaler-client-connector/client-connector-app-release-summary-2021??applicable_category=windows\u0026applicable_version=3.7"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Windows ZCC Upgrade DoS And Privilege Escalation Through RPC Control",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "73c6f63b-efac-410d-a0a9-569700f85a04",
"assignerShortName": "Zscaler",
"cveId": "CVE-2023-41971",
"datePublished": "2024-05-02T13:11:07.860Z",
"dateReserved": "2023-09-06T17:14:12.958Z",
"dateUpdated": "2024-08-06T17:51:01.988Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-42099 (GCVE-0-2023-42099)
Vulnerability from cvelistv5 – Published: 2024-05-03 02:13 – Updated: 2024-08-15 15:50
VLAI
Title
Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability
Summary
Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver & Support Assistant. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the DSA Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21846.
Severity
7.8 (High)
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Intel | Driver & Support Assistant |
Affected:
23.3.25.6
|
Date Public
2023-09-21 18:10
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:intel:driver\\\u0026support_assistant:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "driver\\\u0026support_assistant",
"vendor": "intel",
"versions": [
{
"status": "affected",
"version": "23.3.25.6"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-42099",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-19T14:47:24.000027Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T15:50:14.641Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:16:50.384Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ZDI-23-1449",
"tags": [
"x_research-advisory",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1449/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Driver \u0026 Support Assistant",
"vendor": "Intel",
"versions": [
{
"status": "affected",
"version": "23.3.25.6"
}
]
}
],
"dateAssigned": "2023-09-06T21:25:45.367Z",
"datePublic": "2023-09-21T18:10:14.369Z",
"descriptions": [
{
"lang": "en",
"value": "Intel Driver \u0026 Support Assistant Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver \u0026 Support Assistant. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the DSA Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21846."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-03T02:13:11.158Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-23-1449",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1449/"
}
],
"source": {
"lang": "en",
"value": "Anonymous"
},
"title": "Intel Driver \u0026 Support Assistant Link Following Local Privilege Escalation Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2023-42099",
"datePublished": "2024-05-03T02:13:11.158Z",
"dateReserved": "2023-09-06T21:14:24.432Z",
"dateUpdated": "2024-08-15T15:50:14.641Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-42126 (GCVE-0-2023-42126)
Vulnerability from cvelistv5 – Published: 2024-05-03 02:13 – Updated: 2024-08-02 19:16
VLAI
Title
G DATA Total Security GDBackupSvc Service Link Following Local Privilege Escalation Vulnerability
Summary
G DATA Total Security GDBackupSvc Service Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G Data Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the GDBackupSvc service. By creating a symbolic link, an attacker can abuse the service to create a file with a permissive DACL. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-20694.
Severity
7.8 (High)
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| G DATA | Total Security |
Affected:
25.5.14.95
|
Date Public
2023-09-29 22:01
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:gdata-software:total_security:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "total_security",
"vendor": "gdata-software",
"versions": [
{
"lessThan": "25.5.14.95",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-42126",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-16T19:26:04.983685Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-17T19:33:23.550Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:16:50.529Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ZDI-23-1493",
"tags": [
"x_research-advisory",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1493/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Total Security",
"vendor": "G DATA",
"versions": [
{
"status": "affected",
"version": "25.5.14.95"
}
]
}
],
"dateAssigned": "2023-09-06T21:25:45.540Z",
"datePublic": "2023-09-29T22:01:25.692Z",
"descriptions": [
{
"lang": "en",
"value": "G DATA Total Security GDBackupSvc Service Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G Data Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the GDBackupSvc service. By creating a symbolic link, an attacker can abuse the service to create a file with a permissive DACL. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-20694."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-03T02:13:32.063Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-23-1493",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1493/"
}
],
"source": {
"lang": "en",
"value": "Filip Dragovic (@filip_dragovic)"
},
"title": "G DATA Total Security GDBackupSvc Service Link Following Local Privilege Escalation Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2023-42126",
"datePublished": "2024-05-03T02:13:32.063Z",
"dateReserved": "2023-09-06T21:14:24.437Z",
"dateUpdated": "2024-08-02T19:16:50.529Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-42137 (GCVE-0-2023-42137)
Vulnerability from cvelistv5 – Published: 2024-01-15 13:28 – Updated: 2025-06-17 21:09
VLAI
Summary
PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow for command execution with high privileges by using malicious symlinks.
The attacker must have shell access to the device in order to exploit this vulnerability.
Severity
7.8 (High)
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://ppn.paxengine.com/release/development | vendor-advisory |
| https://blog.stmcyber.com/pax-pos-cves-2023/ | technical-description |
| https://cert.pl/en/posts/2024/01/CVE-2023-4818/ | third-party-advisory |
| https://cert.pl/posts/2024/01/CVE-2023-4818/ | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PAX Technology | POS terminals |
Affected:
0 , ≤ 11.1.50_20230614
(custom)
|
Date Public
2024-01-15 11:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:16:50.659Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://ppn.paxengine.com/release/development"
},
{
"tags": [
"technical-description",
"x_transferred"
],
"url": "https://blog.stmcyber.com/pax-pos-cves-2023/"
},
{
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://cert.pl/en/posts/2024/01/CVE-2023-4818/"
},
{
"tags": [
"third-party-advisory",
"x_transferred"
],
"url": "https://cert.pl/posts/2024/01/CVE-2023-4818/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-42137",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-01-16T15:42:07.754870Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-17T21:09:22.709Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "POS terminals",
"vendor": "PAX Technology",
"versions": [
{
"lessThanOrEqual": "11.1.50_20230614",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Hubert Jasudowicz, Adam Kli\u015b and other members of STM Cyber R\u0026D team"
}
],
"datePublic": "2024-01-15T11:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003ePAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow for command execution with high privileges by using malicious symlinks.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThe attacker must have shell access to the device in order to exploit this vulnerability. \u003cbr\u003e\u003c/div\u003e"
}
],
"value": "PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow for command execution with high privileges by using malicious symlinks.\n\n\n\n\nThe attacker must have shell access to the device in order to exploit this vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-10T15:35:56.930Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://ppn.paxengine.com/release/development"
},
{
"tags": [
"technical-description"
],
"url": "https://blog.stmcyber.com/pax-pos-cves-2023/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/en/posts/2024/01/CVE-2023-4818/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/posts/2024/01/CVE-2023-4818/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2023-42137",
"datePublished": "2024-01-15T13:28:59.106Z",
"dateReserved": "2023-09-07T13:17:57.372Z",
"dateUpdated": "2025-06-17T21:09:22.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-43078 (GCVE-0-2023-43078)
Vulnerability from cvelistv5 – Published: 2024-08-28 05:33 – Updated: 2024-08-28 22:31
VLAI
Summary
Dell Dock Firmware and Dell Client Platform contain an Improper Link Resolution vulnerability during installation resulting in arbitrary folder deletion, which could lead to Privilege Escalation or Denial of Service.
Severity
6.7 (Medium)
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.dell.com/support/kbdoc/en-us/00021798… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dell | Dell Client Platform, Dell Dock Firmware |
Affected:
N/A , < 1.27.0
(semver)
Affected: N/A , < 1.22.0 (semver) Affected: N/A , < 1.14.1 (semver) Affected: N/A , < 1.11.0 (semver) Affected: N/A , < 1.19.0 (semver) Affected: N/A , < 1.20.0 (semver) Affected: N/A , < 1.24.0 (semver) Affected: N/A , < 1.26.0 (semver) Affected: N/A , < 1.12.0 (semver) Affected: N/A , < 1.28.0 (semver) Affected: N/A , < 1.17.0 (semver) Affected: N/A , < 1.23.0 (semver) Affected: N/A , < 1.30.0 (semver) Affected: N/A , < 2.25.0 (semver) Affected: N/A , < 1.16.0 (semver) Affected: N/A , < 1.12.1 (semver) Affected: N/A , < 2.24.0 (semver) Affected: N/A , < 1.8.0 (semver) Affected: N/A , < 1.18.0 (semver) Affected: N/A , < 1.29.0 (semver) Affected: N/A , < 1.24.1 (semver) Affected: N/A , < 1.22.1 (semver) Affected: N/A , < 1.31.0 (semver) Affected: N/A , < 1.25.0 (semver) Affected: N/A , < 1.10.0 (semver) Affected: N/A , < 1.34.0 (semver) Affected: N/A , < 1.32.0 (semver) Affected: N/A , < 1.36.0 (semver) Affected: N/A , < 1.10.1 (semver) Affected: N/A , < 1.36.2 (semver) Affected: N/A , < 1.21.1 (semver) Affected: N/A , < 1.33.0 (semver) Affected: N/A , < 1.35.0 (semver) Affected: N/A , < 1.34.2 (semver) Affected: N/A , < 1.30.1 (semver) Affected: N/A , < 1.15.0 (semver) Affected: N/A , < 2.22.0 (semver) Affected: N/A , < 2.16.0 (semver) Affected: N/A , < 1.22.2 (semver) Affected: N/A , < 1.1.37 (semver) Affected: N/A , < 1.27.1 (semver) Affected: N/A , < 3.3.2 (semver) Affected: N/A , < 1.28.1 (semver) Affected: N/A , < 2.11.1 (semver) Affected: N/A , < 2.28.0 (semver) Affected: N/A , < 1.28.8 (semver) Affected: N/A , < 1.1.16 (semver) Affected: N/A , < 1.20.1 (semver) Affected: N/A , < 1.9.0 (semver) Affected: N/A , < 1.6.1 (semver) Affected: N/A , < 1.1.15 (semver) Affected: N/A , < 2.23.0 (semver) Affected: N/A , < 3.20.0 (semver) Affected: N/A , < 1.19.1 (semver) Affected: N/A , < 2.9.0 (semver) Affected: N/A , < 1.13.0 (semver) Affected: N/A , < 1.0.14.20 (semver) Affected: N/A , < 01.00.15 (semver) Affected: N/A , < 01.00.36 (semver) Affected: N/A , < 4.62.156.006 (semver) Affected: N/A , < 4.66.128.015 (semver) Affected: N/A , < 4.65.111.022 (semver) Affected: N/A , < 4.61.124.014 (semver) Affected: N/A , < 4.46.147.004 (semver) Affected: N/A , < 4.46.134.013 (semver) Affected: N/A , < 4.66.131.016 (semver) Affected: N/A , < 4.46.135.009 (semver) Affected: N/A , < 4.65.162.003 (semver) Affected: N/A , < 4.65.119.017 (semver) Affected: N/A , < 4.62.140.014 (semver) Affected: N/A , < 4.46.166.001 (semver) Affected: N/A , < 4.65.163.002 (semver) Affected: N/A , < 4.62.139.013 (semver) Affected: N/A , < 4.46.112.015 (semver) Affected: N/A , < 4.65.116.019 (semver) Affected: N/A , < 4.46.143.009 (semver) Affected: N/A , < 4.46.145.004 (semver) Affected: N/A , < 4.65.117.031 (semver) Affected: N/A , < 4.62.102.024 (semver) Affected: N/A , < 4.65.108.018 (semver) Affected: N/A , < 4.69.120.013 (semver) Affected: N/A , < 4.46.106.031 (semver) Affected: N/A , < 7.2.2.0 (semver) Affected: N/A , < 74.64 (semver) |
Date Public
2024-02-22 06:30
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:dell:wyse_5070_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_3480_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_3580_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_3583_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_3540_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_3561_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_3640_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_7550_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_7560_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_7750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_7760_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_7780_all-in-one_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_7480_all-in-one_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_5480_all-in-one_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_9420_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5521_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5400_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_3510_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_3410_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_3320_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_3580_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_3480_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:alienware_m15_r6_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "alienware_m15_r6_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.27.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:xps_17_9720_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:xps_13_9300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:wyse_5470_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_14_3420_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_15_3520_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_5570_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_5080_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_7070_ultra_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_3120_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_3310_2-in-1_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5310_2-in-1_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5310_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_15_3520_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:g16_7620_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:g15_5510_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:g15_5520_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:alienware_m15_r7_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "alienware_m15_r7_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.22.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:alienware_m18_r1_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:alienware_m16_r1_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "alienware_m16_r1_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.14.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:vostro_16_5630_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_3020_small_desktop_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_3020_tower_desktop_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_3480_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_all-in-one_7410_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_micro_7010_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_micro_plus_7010_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_small_form_factor_7010_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_small_form_factor_plus_7010_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_tower_7010_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_tower_plus_7010_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5440_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_7340_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_7440_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_7640_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_3020_desktop_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_3020_small_desktop_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_16_5630_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_16_7630_2-in-1_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_14_5430_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_14_7430_2-in-1_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:chengming_3911_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:chengming_3910_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:alienware_x16_r1_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:alienware_x14_r2_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "alienware_x14_r2_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.11.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:xps_13_9305_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_3710_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_3910_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_5620_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_3470_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_5470_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_xe4_tower_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_7000_micro_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_7000_small_form_factor_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_7000_tower_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_7000_xe_micro_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_5000_micro_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_5000_small_form_factor_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_5000_tower_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_3000_micro_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_3000_small_form_factor_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_3000_tower_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_3330_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5330_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5430_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5431_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_3910_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_16_5620_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_14_5420_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:chengming_3900_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "chengming_3900_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.19.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:xps_15_9520_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_15_7510_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_3471_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_3671_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_7620_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_3571_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_5570_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5531_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_7330_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_7430_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_7530_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_9430_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_3671_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_3471_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_16_plus_7620_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_16_7610_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_15_7510_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_14_plus_7420_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:chengming_3988_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "chengming_3988_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.20.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:xps_17_9710_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_5090_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_3550_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_5760_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_3070_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_5070_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_7070_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_7071_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_9510_2in1_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5510_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5410_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_7700_all-in-one_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_7490_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_5401_aio_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_5401_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_5400_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:chengming_3990_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:chengming_3991_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "chengming_3991_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.24.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:xps_15_9500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_7500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_3590_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_15_3510_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_5550_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_3280_all-in-one_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_5270_all-in-one_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_7470_all-in-one_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_7770_all-in-one_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_7410_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_7310_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_7210_2-in-1_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_7200_2-in-1_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5421_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_7501_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_7500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_15_3511_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:g15_5511_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "g15_5511_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.26.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:latitude_7230_rugged_extreme_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_3140_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_16_plus_7630_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_14_plus_7430_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:g16_7630_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:g15_5530_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "g15_5530_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.12.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:xps_17_9700_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_3400_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_3401_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_3500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_3501_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_5402_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_5502_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_3541_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_5750_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_xe3_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_7060_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_5060_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_3060_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5401_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5501_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_7300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_7320_detachable_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_7400_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_3501_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_5402_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_5406_2-in-1_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_5409_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_5502_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_5509_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_7306_2-in-1_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_7506_2-in-1_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_7706_2-in-1_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_3430_tower_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:g5_5500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:g3_3500_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "g3_3500_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.28.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:latitude_9330_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_16_7620_2-in-1_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_14_7420_2-in-1_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:g5_5000_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "g5_5000_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.17.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:xps_13_7390_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:wyse_5470_all-in-one_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_5880_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_3240_compact_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_3440_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_7080_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_7330_rugged_laptop_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5430_rugged_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_3310_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_3431_tower_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:g5_5090_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "g5_5090_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.23.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:precision_3530_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_7760_all-in-one_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_7460_all_in_one_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_5260_all-in-one_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5491_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5591_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:dell_g7_7500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:dell_g7_7700_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "dell_g7_7700_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.30.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:vostro_13_5310_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_13_5310_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_3630_tower_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "precision_3630_tower_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "2.25.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:vostro_5320_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_3530_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_3430_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_13_5320_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "inspiron_13_5320_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.16.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:inspiron_13_5330_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "inspiron_13_5330_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.12.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:vostro_15_5510_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_14_5410_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_5410_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_15_5510_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_15_5518_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_14_5418_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_14_5410_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "inspiron_14_5410_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "2.24.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:vostro_14_3430_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_15_3530_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_5480_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_9440_2-in-1_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_27_7720_all-in-one_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_24_5420_all-in-one_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_15_3530_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "inspiron_15_3530_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.8.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:inspiron_27_7710_all-in-one_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_24_5410_all-in-one_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_24_5411_all-in-one_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "inspiron_24_5411_all-in-one_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.18.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:xps_13_7390_2-in-1_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_7740_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_7540_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_7424_rugged_extreme_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5420_rugged_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5424_rugged_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5300_2-in-1_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_3301_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_5593_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_3793_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_3593_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "inspiron_3593_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.29.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:inspiron_3881_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_3880_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "inspiron_3880_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.24.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:vostro_5890_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_3890_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:vostro_3690_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_3450_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_3891_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "inspiron_3891_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.22.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:vostro_5301_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_7730_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_7530_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5290_2-in-1_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_3500_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_3400_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_3190_2-in-1_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_3190_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_7400_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_7300_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:inspiron_5301_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "inspiron_5301_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.31.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:xps_15_7590_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:xps_15_9510_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_5560_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_5540_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_3551_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_7090_ultra_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_3090_ultra_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_9410_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_7400_2-in-1_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5511_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5411_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_3300_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "latitude_3300_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.25.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:xps_15_9530_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_5680_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_3540_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_3440_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_3340_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "latitude_3340_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.10.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:precision_5530_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_3520_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_3420_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "latitude_3420_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.34.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:latitude_5590_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5490_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5290_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "latitude_5290_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.32.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:precision_3560_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5520_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5320_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "latitude_5320_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.36.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:precision_3580_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_3581_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5540_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5340_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "latitude_5340_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.10.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:latitude_5420_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "latitude_5420_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.36.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:precision_3570_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_5530_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "latitude_5530_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.21.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:latitude_rugged_7220_extreme_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_7220_rugged_extreme_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "latitude_7220_rugged_extreme_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.33.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:latitude_7490_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_7390_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_7290_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "latitude_7290_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.35.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:latitude_7520_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_7420_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:latitude_7320_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "latitude_7320_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.34.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:latitude_9520_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "latitude_9520_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.30.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:optiplex_3000_thin_client_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "optiplex_3000_thin_client_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.15.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:xps_13_9310_2-in-1_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_3080_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "optiplex_3080_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "2.22.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:xps_8940_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_3090_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "optiplex_3090_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "2.16.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:optiplex_7090_tower_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_5090_micro_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_5090_small_form_factor_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_5090_tower_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "optiplex_5090_tower_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.22.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:optiplex_7400_all-in-one_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_5400_all-in-one_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "optiplex_5400_all-in-one_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.1.37",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:optiplex_7490_all-in-one_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:optiplex_5490_all-in-one_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "optiplex_5490_all-in-one_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.27.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:precision_3460_small_form_factor_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_3460_xe_small_form_factor_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_3260_compact_firmware:-:*:*:*:*:*:*:*",
"cpe:2.3:o:dell:precision_3260_xe_compact_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "precision_3260_xe_compact_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "3.3.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:precision_3650_tower_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "precision_3650_tower_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "1.28.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:dell:precision_3660_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "precision_3660_firmware",
"vendor": "dell",
"versions": [
{
"lessThan": "2.11.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-43078",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-28T14:17:19.963412Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-28T22:31:00.645Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Dell Client Platform, Dell Dock Firmware",
"vendor": "Dell",
"versions": [
{
"lessThan": "1.27.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.22.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.14.1",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.11.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.19.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.20.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.24.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.26.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.12.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.28.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.17.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.23.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.30.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "2.25.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.16.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.12.1",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "2.24.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.8.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.18.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.29.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.24.1",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.22.1",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.31.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.25.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.10.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.34.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.32.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.36.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.10.1",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.36.2",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.21.1",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.33.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.35.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.34.2",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.30.1",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.15.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "2.22.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "2.16.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.22.2",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.1.37",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.27.1",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "3.3.2",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.28.1",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "2.11.1",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "2.28.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.28.8",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.1.16",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.20.1",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.9.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.6.1",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.1.15",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "2.23.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "3.20.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.19.1",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "2.9.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.13.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "1.0.14.20",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "01.00.15",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "01.00.36",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.62.156.006",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.66.128.015",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.65.111.022",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.61.124.014",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.46.147.004",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.46.134.013",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.66.131.016",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.46.135.009",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.65.162.003",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.65.119.017",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.62.140.014",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.46.166.001",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.65.163.002",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.62.139.013",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.46.112.015",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.65.116.019",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.46.143.009",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.46.145.004",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.65.117.031",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.62.102.024",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.65.108.018",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.69.120.013",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "4.46.106.031",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "7.2.2.0",
"status": "affected",
"version": "N/A",
"versionType": "semver"
},
{
"lessThan": "74.64",
"status": "affected",
"version": "N/A",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-02-22T06:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Dell Dock Firmware and Dell Client Platform contain an Improper Link Resolution vulnerability during installation resulting in arbitrary folder deletion, which could lead to Privilege Escalation or Denial of Service."
}
],
"value": "Dell Dock Firmware and Dell Client Platform contain an Improper Link Resolution vulnerability during installation resulting in arbitrary folder deletion, which could lead to Privilege Escalation or Denial of Service."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-28T05:33:16.899Z",
"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"shortName": "dell"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.dell.com/support/kbdoc/en-us/000217981/dsa-2023-362-security-update-for-dell-dock-firmware-and-dell-client-platform-for-an-improper-link-resolution-vulnerability"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"assignerShortName": "dell",
"cveId": "CVE-2023-43078",
"datePublished": "2024-08-28T05:33:16.899Z",
"dateReserved": "2023-09-15T07:02:11.648Z",
"dateUpdated": "2024-08-28T22:31:00.645Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-43590 (GCVE-0-2023-43590)
Vulnerability from cvelistv5 – Published: 2023-11-14 23:15 – Updated: 2024-08-29 17:23
VLAI
Summary
Link following in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access.
Severity
7.8 (High)
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zoom Video Communications, Inc. | Zoom Rooms for macOS |
Affected:
before 5.16.0
|
Date Public
2023-11-14 16:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:44:43.776Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://explore.zoom.us/en/trust/security/security-bulletin/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-43590",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-29T17:23:15.568469Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-29T17:23:41.033Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"MacOS"
],
"product": "Zoom Rooms for macOS",
"vendor": "Zoom Video Communications, Inc.",
"versions": [
{
"status": "affected",
"version": "before 5.16.0"
}
]
}
],
"datePublic": "2023-11-14T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Link following in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access.\u003cbr\u003e"
}
],
"value": "Link following in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access.\n"
}
],
"impacts": [
{
"capecId": "CAPEC-132",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-132 Symlink Attack"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-14T23:15:12.437Z",
"orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
"shortName": "Zoom"
},
"references": [
{
"url": "https://explore.zoom.us/en/trust/security/security-bulletin/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
"assignerShortName": "Zoom",
"cveId": "CVE-2023-43590",
"datePublished": "2023-11-14T23:15:12.437Z",
"dateReserved": "2023-09-19T22:05:40.666Z",
"dateUpdated": "2024-08-29T17:23:41.033Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-45159 (GCVE-0-2023-45159)
Vulnerability from cvelistv5 – Published: 2023-10-05 10:11 – Updated: 2025-06-18 18:40
VLAI
Title
1E Client installer can perform arbitrary file deletion on protected files
Summary
1E Client installer can perform arbitrary file deletion on protected files.
A non-privileged user could provide a symbolic link or Windows junction to point to a protected directory in the installer that the 1E Client would then clear on service startup.
A hotfix is available from the 1E support portal that forces the 1E Client to check for a symbolic link or junction and if it finds one refuses to use that path and instead creates a path involving a random GUID.
for v8.1 use hotfix Q23097
for v8.4 use hotfix Q23105
for v9.0 use hotfix Q23115
for SaaS customers, use 1EClient v23.7 plus hotfix Q23121
Severity
8.4 (High)
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
1 reference
Impacted products
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T20:14:19.830Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.1e.com/trust-security-compliance/cve-info/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:1e:client:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "client",
"vendor": "1e",
"versions": [
{
"lessThan": "8.1.2.62",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "8.4.1.159",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "9.0.1.88",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "23.7.1.151",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-45159",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-19T17:33:38.940543Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-17T14:24:11.447Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows"
],
"product": "1E Client",
"vendor": "1E",
"versions": [
{
"changes": [
{
"at": "Q23097",
"status": "unaffected"
}
],
"lessThan": "8.1.2.62",
"status": "affected",
"version": "0",
"versionType": "Q23097"
},
{
"changes": [
{
"at": "Q23105",
"status": "unaffected"
}
],
"lessThan": "8.4.1.159",
"status": "affected",
"version": "0",
"versionType": "Q23105"
},
{
"changes": [
{
"at": "Q23115",
"status": "unaffected"
}
],
"lessThan": "9.0.1.88",
"status": "affected",
"version": "0",
"versionType": "Q23115"
},
{
"changes": [
{
"at": "Q23121",
"status": "unaffected"
}
],
"lessThan": "23.7.1.151",
"status": "affected",
"version": "0",
"versionType": "Q23121"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Thanks to Lockheed Martin red team who reported this issue."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "1E Client installer can perform arbitrary file deletion on protected files.\u0026nbsp;\u0026nbsp;\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA non-privileged user could provide a symbolic link or Windows junction to point to a protected directory in the installer that the 1E Client would then clear on service startup. \u003cbr\u003e\u003cbr\u003eA hotfix is available from the 1E support portal that forces\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ethe 1E Client to check for a symbolic link or junction and if it finds one refuses to use that path and instead creates a path involving a random GUID.\u003cbr\u003e\u003cbr\u003efor v8.1 use hotfix Q23097\u003cbr\u003efor v8.4 use hotfix Q23105\u003cbr\u003efor v9.0 use hotfix Q23115\u003cbr\u003e\u003cbr\u003efor SaaS customers, use 1EClient v23.7 plus hotfix Q23121\u003c/span\u003e\u003c/span\u003e"
}
],
"value": "1E Client installer can perform arbitrary file deletion on protected files.\u00a0\u00a0\n\nA non-privileged user could provide a symbolic link or Windows junction to point to a protected directory in the installer that the 1E Client would then clear on service startup. \n\nA hotfix is available from the 1E support portal that forces\u00a0the 1E Client to check for a symbolic link or junction and if it finds one refuses to use that path and instead creates a path involving a random GUID.\n\nfor v8.1 use hotfix Q23097\nfor v8.4 use hotfix Q23105\nfor v9.0 use hotfix Q23115\n\nfor SaaS customers, use 1EClient v23.7 plus hotfix Q23121"
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-18T18:40:58.223Z",
"orgId": "4a68d2b9-b68a-4765-95bd-17f35092666b",
"shortName": "1E"
},
"references": [
{
"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/1e-2023-2001/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "1E Client installer can perform arbitrary file deletion on protected files",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "4a68d2b9-b68a-4765-95bd-17f35092666b",
"assignerShortName": "1E",
"cveId": "CVE-2023-45159",
"datePublished": "2023-10-05T10:11:20.065Z",
"dateReserved": "2023-10-04T23:59:54.078Z",
"dateUpdated": "2025-06-18T18:40:58.223Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-4759 (GCVE-0-2023-4759)
Vulnerability from cvelistv5 – Published: 2023-09-12 09:12 – Updated: 2024-08-02 07:37
VLAI
Title
Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write
Summary
Arbitrary File Overwrite in Eclipse JGit <= 6.6.0
In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive filesystem, or when a checkout from a clone of such a repository is performed on a case-insensitive filesystem.
This can happen on checkout (DirCacheCheckout), merge (ResolveMerger via its WorkingTreeUpdater), pull (PullCommand using merge), and when applying a patch (PatchApplier). This can be exploited for remote code execution (RCE), for instance if the file written outside the working tree is a git filter that gets executed on a subsequent git command.
The issue occurs only on case-insensitive filesystems, like the default filesystems on Windows and macOS. The user performing the clone or checkout must have the rights to create symbolic links for the problem to occur, and symbolic links must be enabled in the git configuration.
Setting git configuration option core.symlinks = false before checking out avoids the problem.
The issue was fixed in Eclipse JGit version 6.6.1.202309021850-r and 6.7.0.202309050840-r, available via Maven Central https://repo1.maven.org/maven2/org/eclipse/jgit/ and repo.eclipse.org https://repo.eclipse.org/content/repositories/jgit-releases/ . A backport is available in 5.13.3 starting from 5.13.3.202401111512-r.
The JGit maintainers would like to thank RyotaK for finding and reporting this issue.
Severity
8.8 (High)
CWE
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse JGit |
Affected:
0.0.0 , ≤ 6.6.0.202305301015-r
(semver)
Unaffected: 5.13.3.202401111512-r |
Date Public
2023-09-12 10:00
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:eclipse:jgit:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "jgit",
"vendor": "eclipse",
"versions": [
{
"lessThanOrEqual": "6.6.0.202305301015-r",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:eclipse:jgit:5.13.3.202401111512-r:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "jgit",
"vendor": "eclipse",
"versions": [
{
"status": "unaffected",
"version": "5.13.3.202401111512-r"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-4759",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-19T03:55:38.083883Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-19T13:51:38.023Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:37:59.574Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/11"
},
{
"tags": [
"x_transferred"
],
"url": "https://projects.eclipse.org/projects/technology.jgit/releases/6.6.1"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.eclipse.org/c/jgit/jgit.git/commit/?id=9072103f3b3cf64dd12ad2949836ab98f62dabf1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://git.eclipse.org/c/jgit/jgit.git/",
"defaultStatus": "unaffected",
"product": "Eclipse JGit",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "6.6.0.202305301015-r",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": " 5.13.3.202401111512-r"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "RyotaK"
}
],
"datePublic": "2023-09-12T10:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eArbitrary File Overwrite in Eclipse JGit \u0026lt;= 6.6.0\u003c/p\u003e\u003cp\u003eIn Eclipse JGit, all versions \u0026lt;= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive filesystem, or when a checkout from a clone of such a repository is performed on a case-insensitive filesystem.\u003c/p\u003e\u003cp\u003eThis can happen on checkout (\u003ccode\u003eDirCacheCheckout\u003c/code\u003e), merge (\u003ccode\u003eResolveMerger\u003c/code\u003e\u0026nbsp;via its \u003ccode\u003eWorkingTreeUpdater\u003c/code\u003e), pull (\u003ccode\u003ePullCommand\u003c/code\u003e\u0026nbsp;using merge), and when applying a patch (\u003ccode\u003ePatchApplier\u003c/code\u003e). This can be exploited for remote code execution (RCE), for instance if the file written outside the working tree is a git filter that gets executed on a subsequent git command.\u003c/p\u003e\u003cp\u003eThe issue occurs only on case-\u003cstrong\u003ein\u003c/strong\u003esensitive filesystems, like the default filesystems on Windows and macOS. The user performing the clone or checkout must have the rights to create symbolic links for the problem to occur, and symbolic links must be enabled in the git configuration.\u003c/p\u003e\u003cp\u003eSetting git configuration option \u003ccode\u003ecore.symlinks = false\u003c/code\u003e\u0026nbsp;before checking out avoids the problem.\u003c/p\u003e\u003cp\u003eThe issue was fixed in Eclipse JGit version 6.6.1.202309021850-r and 6.7.0.202309050840-r, available via \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://repo1.maven.org/maven2/org/eclipse/jgit/\"\u003eMaven Central\u003c/a\u003e\u0026nbsp;and \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://repo.eclipse.org/content/repositories/jgit-releases/\"\u003erepo.eclipse.org\u003c/a\u003e. A backport is available in 5.13.3 starting from 5.13.3.202401111512-r.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eThe JGit maintainers would like to thank RyotaK for finding and reporting this issue.\u003cbr\u003e\u003c/p\u003e\u003cbr\u003e"
}
],
"value": "Arbitrary File Overwrite in Eclipse JGit \u003c= 6.6.0\n\nIn Eclipse JGit, all versions \u003c= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive filesystem, or when a checkout from a clone of such a repository is performed on a case-insensitive filesystem.\n\nThis can happen on checkout (DirCacheCheckout), merge (ResolveMerger\u00a0via its WorkingTreeUpdater), pull (PullCommand\u00a0using merge), and when applying a patch (PatchApplier). This can be exploited for remote code execution (RCE), for instance if the file written outside the working tree is a git filter that gets executed on a subsequent git command.\n\nThe issue occurs only on case-insensitive filesystems, like the default filesystems on Windows and macOS. The user performing the clone or checkout must have the rights to create symbolic links for the problem to occur, and symbolic links must be enabled in the git configuration.\n\nSetting git configuration option core.symlinks = false\u00a0before checking out avoids the problem.\n\nThe issue was fixed in Eclipse JGit version 6.6.1.202309021850-r and 6.7.0.202309050840-r, available via Maven Central https://repo1.maven.org/maven2/org/eclipse/jgit/ \u00a0and repo.eclipse.org https://repo.eclipse.org/content/repositories/jgit-releases/ . A backport is available in 5.13.3 starting from 5.13.3.202401111512-r.\n\n\nThe JGit maintainers would like to thank RyotaK for finding and reporting this issue.\n\n\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-132",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-132 Symlink Attack"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-178",
"description": "CWE-178 Improper Handling of Case Sensitivity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-12T15:21:24.101Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/11"
},
{
"url": "https://projects.eclipse.org/projects/technology.jgit/releases/6.6.1"
},
{
"url": "https://git.eclipse.org/c/jgit/jgit.git/commit/?id=9072103f3b3cf64dd12ad2949836ab98f62dabf1"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSetting git configuration option \u003ccode\u003ecore.symlinks = false\u003c/code\u003e\u0026nbsp;before checking out avoids the problem.\u003c/p\u003e"
}
],
"value": "Setting git configuration option core.symlinks = false\u00a0before checking out avoids the problem.\n\n"
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2023-4759",
"datePublished": "2023-09-12T09:12:10.254Z",
"dateReserved": "2023-09-04T16:06:00.689Z",
"dateUpdated": "2024-08-02T07:37:59.574Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-50197 (GCVE-0-2023-50197)
Vulnerability from cvelistv5 – Published: 2024-05-03 02:14 – Updated: 2024-08-15 15:50
VLAI
Title
Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability
Summary
Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver & Support Assistant. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the DSA Service. By creating a symbolic link, an attacker can abuse the service to write a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21845.
Severity
7.8 (High)
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Intel | Driver & Support Assistant |
Affected:
23.3.25.6
|
Date Public
2023-12-13 18:13
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:intel:driver\\\u0026support_assistant:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "driver\\\u0026support_assistant",
"vendor": "intel",
"versions": [
{
"status": "affected",
"version": "23.3.25.6"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-50197",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-19T14:38:03.377106Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T15:50:50.156Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T22:09:49.786Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ZDI-23-1773",
"tags": [
"x_research-advisory",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1773/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Driver \u0026 Support Assistant",
"vendor": "Intel",
"versions": [
{
"status": "affected",
"version": "23.3.25.6"
}
]
}
],
"dateAssigned": "2023-12-05T19:37:59.540Z",
"datePublic": "2023-12-13T18:13:10.483Z",
"descriptions": [
{
"lang": "en",
"value": "Intel Driver \u0026 Support Assistant Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver \u0026 Support Assistant. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the DSA Service. By creating a symbolic link, an attacker can abuse the service to write a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21845."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-03T02:14:22.353Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-23-1773",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1773/"
}
],
"source": {
"lang": "en",
"value": "Anonymous"
},
"title": "Intel Driver \u0026 Support Assistant Link Following Local Privilege Escalation Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2023-50197",
"datePublished": "2024-05-03T02:14:22.353Z",
"dateReserved": "2023-12-05T16:15:17.539Z",
"dateUpdated": "2024-08-15T15:50:50.156Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation ID: MIT-48.1
Phase: Architecture and Design
Strategy: Separation of Privilege
Description:
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CAPEC-132: Symlink Attack
An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.
CAPEC-17: Using Malicious Files
An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.