CVE-2016-9602CWE-59

Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS

High · published April 26, 2018

CVSS v3.0
7.6
EPSS
4%
Percentile
89.5
In the wild
Unconfirmed
What it is

Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host.

The record
Technical detail
CVSS v3.0
7.6 · HIGH
Vector
CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03649 · 89.5th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2018-04-26T19:00Z
EPSS history
Timeline
  • 26 APR 19:00Z
    Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS
    cvelistv5