How severe is CVE-2024-1753?

This vulnerability has a severity rating of HIGH with a CVSS score of 8.6 out of 10.

What type of vulnerability is CVE-2024-1753?

This is classified as CWE-59, which is a common weakness in software security.

CVE-2024-1753

HIGH Year: 2024

CVSS v3 Score

8.6

High

Weakness Type

CWE-59

View all →

Vulnerability Description

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.

CVE-2019-18837

HIGH

CVSS:8.6(High)

An issue was discovered in crun before 0.10.5. With a crafted image, it doesn't correctly check whether a target is a symlink, resulting in access to files outside of the container. This occurs in lib...

CWE-592019

CVE-2015-6566

HIGH

CVSS:8.4(High)

zarafa-autorespond in Zarafa Collaboration Platform (ZCP) before 7.2.1 allows local users to gain privileges via a symlink attack on /tmp/zarafa-vacation-*.

CWE-592015

CVE-2021-41641

HIGH

CVSS:8.4(High)

Deno <=1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain access to any directory.

CWE-592021

CVE-2023-45159

HIGH

CVSS:8.4(High)

1E Client installer can perform arbitrary file deletion on protected files. A non-privileged user could provide a symbolic link or Windows junction to point to a protected directory in the installer t...

CWE-592023