CVE-2024-45770CWE-59
Pcp: pmpost symlink attack allows escalating pcp to root user
Medium · published September 19, 2024
What it is
A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges.
The record
Technical detail
- CVSS v3.1
- 4.4 · MEDIUM
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00285 · 20.0th percentile
- Weakness
- CWE-59 · Improper Link Resolution Before File Access ('Link Following')
- Published
- 2024-09-19T08:45Z
EPSS history
Timeline