PT-2022-5231 · Samba+1 · Samba+1

Tej Rathi · Published 2022-10-19 · Updated 2025-04-08 · CVE-2022-3592

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Samba (affected versions not specified)

Description A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks to files outside the 'smbd' configured share path and gain access to another restricted server's filesystem.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Weakness Enumeration

CWE-61

CWE-59

Related Identifiers

BDU:2022-06494

CVE-2022-3592

MGASA-2023-0010

OPENSUSE-SU-2024:12454-1

Affected Products

Red Os

Samba

References · 47

• https://nvd.nist.gov/vuln/detail/CVE-2022-3592 · Security Note
• https://bdu.fstec.ru/vul/2022-06494 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/FXHIAIPMFZWDIVEPCU6MTIM33HSORPOQ · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3592 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-3592 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0010 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0010.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/VCTYD5EQRS73QZTWPOC2ZO2FL7MMYXMS · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/RWT32WRO3GIUCYYBMM7WJSBXB7UVCOAU · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-3592 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/YOHL3O2H4FYUTUK2D4PURO24UAX3EBPW · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12454-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202309-06 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/G2CYDXPFBQES2Z4KLZDILGXFFQ3VIGZ4 · Vendor Advisory