Описание
Syncthing vulnerable to symlink traversal and arbitrary file overwrite
Syncthing version 0.14.33 and older erronously versions symlinks when they are deleted. If a directory is then created with the same name, a file created in that directory, and the file deleted, it is moved into the symlink target. This can lead to symlink traversal resulting in arbitrary file overwrite.
Пакеты
Наименование
github.com/syncthing/syncthing
go
Затронутые версииВерсия исправления
<= 0.14.33
Отсутствует
Связанные уязвимости
CVSS3: 7.5
ubuntu
почти 8 лет назад
Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwrite
CVSS3: 7.5
nvd
почти 8 лет назад
Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwrite
CVSS3: 7.5
debian
почти 8 лет назад
Syncthing version 0.14.33 and older is vulnerable to symlink traversal ...
