CVE-2017-7549

MEDIUM Year: 2017
CVSS v3 Score
6.4
Medium
CVSS v2 Score
3.3
Low
Weakness Type
CWE-377
View all →

Vulnerability Description

A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat OpenStack Newton, where pre-install and security policy scripts used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.

Related Vulnerabilities

CVE-2017-16024

MEDIUM
CVSS:6.5(Medium)

The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9. Sync-exec uses tmp directories as a buffer before returning values. Other users on the server have read access...

CWE-3772017

CVE-2017-20147

MEDIUM
CVSS:6.5(Medium)

In the ebuild package through smokeping-2.7.3-r1 for SmokePing on Gentoo, the initscript uses a PID file that is writable by the smokeping user. By writing arbitrary PIDs to that file, the smokeping u...

CWE-3772017

CVE-2022-26386

MEDIUM
CVSS:6.5(Medium)

Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>, but this behavior was changed to download them to <code>/tmp</code> where they ...

CWE-3772022

CVE-2024-23287

MEDIUM
CVSS:6.5(Medium)

A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4, watchOS 10.4. An app may be able to access user-sensitive d...

CWE-3772024

CVE-2020-8027

MEDIUM
CVSS:6.6(Medium)

A Insecure Temporary File vulnerability in openldap2 of SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Leap 15.2 allows local attackers to ...

CWE-3772020

CVE-2022-21945

MEDIUM
CVSS:6.1(Medium)

A Insecure Temporary File vulnerability in cscreen of openSUSE Factory allows local attackers to cause DoS for cscreen and a system DoS for non-default systems. This issue affects: openSUSE Factory cs...

CWE-3772022