Weaknesses of type CWE-1386

15 results

Operação insegura em ponto de junção ou montagem do Windows

A aplicação acessa ou manipula arquivos sem validar se o caminho é um ponto de junção (junction) ou ponto de montagem (mount point) do Windows. Um atacante cria um junction apontando para um diretório sensível, fazendo a app ler/escrever em locais não intencionais, contornando controles de acesso.

Example

Uma ferramenta de backup segue um caminho como 'C:\Users\AppData' sem checar se é um junction. O atacante cria um junction em AppData apontando para 'C:\Windows\System32'. A app então acessa ou modifica arquivos críticos do sistema, acreditando estar em uma área segura.

How to mitigate

Ao acessar caminhos, use APIs Windows como GetFinalPathNameByHandle() ou verifique se o caminho é um reparse point (junction) antes de operar. Implemente validação de lista branca de diretórios permitidos e evite traversal de pontos de montagem.

CVE-2023-40623MEDIUMArbitrary File Delete via Directory Junction in SAP BusinessObjects Suite(installer)EPSS 0.4%CVE-2024-7400HIGHLocal privilege escalation in ESET products for WindowsEPSS 0.2%CVE-2023-5834LOWVagrant’s Windows Installer Allowed Directory Junction WriteEPSS 0.2%CVE-2022-42291HIGH NVIDIA GeForce Experience contains a vulnerability in the installer, where a user installing the NVIDIA GeForce Experience software may inaEPSS 0.2%CVE-2023-28065MEDIUM Dell Command | Update, Dell Update, and Alienware Update versions 4.8.0 and prior contain an Insecure Operation on Windows Junction / MountEPSS 0.2%CVE-2023-32474MEDIUM Dell Display Manager application, version 2.1.1.17 and prior, contain an insecure operation on windows junction/mount point. A local maliciEPSS 0.2%CVE-2023-28071MEDIUM Dell Command | Update, Dell Update, and Alienware Update versions 4.9.0, A01 and prior contain an Insecure Operation on Windows Junction / EPSS 0.2%CVE-2023-23697MEDIUMDell Command | Intel vPro Out of Band, versions before 4.4.0, contain an arbitrary folder delete vulnerability during uninstallation. A locaEPSS 0.2%CVE-2023-23698MEDIUM Dell Command | Update, Dell Update, and Alienware Update versions before 4.6.0 and 4.7.1 contain Insecure Operation on Windows Junction in EPSS 0.2%CVE-2023-24572MEDIUM Dell Command | Integration Suite for System Center, versions before 6.4.0 contain an arbitrary folder delete vulnerability during uninstallEPSS 0.2%CVE-2023-32454MEDIUM DUP framework version 4.9.4.36 and prior contains insecure operation on Windows junction/Mount point vulnerability. A local malicious standEPSS 0.2%CVE-2023-32470MEDIUM Dell Digital Delivery versions prior to 5.0.82.0 contain an Insecure Operation on Windows Junction / Mount Point vulnerability. A local malEPSS 0.2%CVE-2024-36340MEDIUMA junction point vulnerability within AMD uProf can allow a local low-privileged attacker to create junction points, potentially resulting EPSS 0.1%CVE-2025-58074HIGHPrivilege escalation during the installation of Norton Secure VPN via the Microsoft StoreEPSS 0.1%CVE-2026-41116MEDIUMDell Inventory Collector Client, versions prior to 13.8.0, contain an Improper Link Resolution Before File Access ('Link Following') vulneraEPSS 0.1%