CVE-2021-32557CWE-59CWE-61

apport process_report() arbitrary file write

Medium · published June 12, 2021

CVSS v3.1
5.2
EPSS
0%
Percentile
32.0
In the wild
Unconfirmed
What it is

It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks.

The record
Technical detail
CVSS v3.1
5.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00390 · 32.0th percentile
Weaknesses
CWE-59 · Improper Link Resolution Before File Access ('Link Following'); CWE-61 · UNIX Symbolic Link (Symlink) Following
Published
2021-06-12T03:40Z
EPSS history
Timeline
  • 12 JUN 03:40Z
    apport process_report() arbitrary file write
    cvelistv5