EXPOSURES › CVE-2022-32207
CVE-2022-32207
CRITICAL
DETAIL
SourceNVD · cve
Published2022-07-07
CVSS9.8
Referencehttps://nvd.nist.gov/vuln/detail/CVE-2022-32207 ↗
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
PLAYERS IMPLICATED
NetApp · vendorSplunk · vendorapple · vendordebian · vendorfedoraproject · vendorhaxx · vendorbootstrap os · productclustered data ontap · productcurl · productdebian linux · productelement software · productfedora · producth300s · producth300s firmware · producth410s · producth410s firmware · producth500s · producth500s firmware · producth700s · producth700s firmware · producthci compute node · producthci management node · productmacos · productsolidfire · productuniversal forwarder · product
DESCRIPTION
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.
AFFECTED FEDRAMP PRODUCTS · 3
| PRODUCT | STATUS |
|---|---|
| Cloud Insights NetApp |
In Process |
| Splunk Cloud Platform for FedRAMP High Splunk |
In Process |
| Splunk Cloud Platform for FedRAMP Moderate Splunk |
Authorized |