CVE-2024-46062
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
Description
Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During installation, world-writable files are created and executed with root privileges. This flaw allows a local low-privileged user to inject arbitrary commands, leading to code execution as the root user.
Affected (1)
Products: Conda: Miniconda3
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Before 23.11.0-1 |
| Running on/with | Platform Versions |
|---|---|
Apple Macos | All versions |
Related CWEs
CWE-732
Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
References (2)
Source: cve@mitre.org
ExploitThird Party Advisory
Source: cve@mitre.org
Release Notes
Timeline
No history available yet.