CVE-2018-12561

Published: Jun 19, 2018Modified: Nov 21, 2024

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. A regular user can inject additional mount options such as file_mode= by manipulating (for example) the domain parameter of the samba URL.

Affected (1)

Products: Cantata Project: Cantata

Cantata Project

1 product

Cantata

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cantata Project Cantata	Up to 2.3.1

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

http://www.openwall.com/lists/oss-security/2018/06/18/1

Source: cve@mitre.org

Mailing ListTechnical Description

https://github.com/CDrummond/cantata/commit/afc4f8315d3e96574925fb530a7004cc9e6ce3d3

Source: cve@mitre.org

PatchTechnical Description

http://www.openwall.com/lists/oss-security/2018/06/18/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListTechnical Description

https://github.com/CDrummond/cantata/commit/afc4f8315d3e96574925fb530a7004cc9e6ce3d3

Source: af854a3a-2127-422b-91ae-364da2661108

PatchTechnical Description

Timeline

No history available yet.