CVE-2022-3592

MEDIUM

Samba 4.17.0-4.17.1 - Symbolic Link Following via SMB1 Unix Extensions or NFS

Title source: llm
STIX 2.1

Description

A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks to files outside the 'smbd' configured share path and gain access to another restricted server's filesystem.

References (4)

Core 4

Scores

CVSS v3 6.5
EPSS 0.0243
EPSS Percentile 82.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-61 CWE-59
Status published
Products (3)
fedoraproject/fedora 36
fedoraproject/fedora 37
samba/samba 4.17.0 - 4.17.2
Published Jan 12, 2023
Tracked Since Feb 18, 2026