CVE-2019-17365

· HIGHModified

← All CVEs

CVSS v3.1

7.8

EPSS

0.43%

Published

Oct 9, 2019

Modified

Jan 15, 2025

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-276

Affected Products (1)

nixos · nixvulnerable

References (6)

http://www.openwall.com/lists/oss-security/2019/10/09/4

ExploitMailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2019/10/10/1

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2019/10/17/3

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2019/10/09/4

ExploitMailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2019/10/10/1

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2019/10/17/3

Mailing ListThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs