Path Traversal in Opensuse Cryptctl
CVE-2017-9270
In cryptctl before version 2.0 a malicious server could send RPC requests that could overwrite files outside of the cryptctl key database.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.020 (78.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.7 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N.
Affected products
- Opensuse Cryptctl — versions 2.0
- Suse Cryptctl — versions unspecified
Weakness classification (CWE)
References
- security@opentext.com (vendor-advisory, x_refsource_SUSE)
- security@opentext.com (x_refsource_CONFIRM)
- security@opentext.com (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2017-9270?
- CVE-2017-9270 is a high-severity vulnerability in Opensuse Cryptctl, classified under Path Traversal. CVSS score: 8.7/10. Published 2018-03-01.
- How severe is CVE-2017-9270?
- High severity. CVSS v3 base score is 8.7 out of 10.