Path Traversal in Cantata Project
CVE-2018-12559
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The mount target path check in mounter.cpp `mpOk()` is insufficient. A regular user can consequently mount a CIFS filesystem anywhere (e.g., outside of the /home directory tree) by passing directory traversal sequences such as a home/../usr substring.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.021 (80.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 81st percentile — 80.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.021 · newest: 0.021 · change: 0.000
Affected products
Weakness classification (CWE)
References
- github.com/CDrummond/cantata/commit/afc4f8315d3e96574925fb530a7004cc9e6ce3d3 (Technical Description, Patch)
- www.openwall.com/lists/oss-security/2018/06/18/1 (Technical Description, Mailing List)
Frequently asked questions
- What is CVE-2018-12559?
- CVE-2018-12559 is a high-severity vulnerability in Cantata Project, classified under Path Traversal. CVSS score: 8.8/10. Published 2018-06-19.
- How severe is CVE-2018-12559?
- High severity. CVSS v3 base score is 8.8 out of 10.