Maple Labs

CVE search · CVE-2022-26488

CVE-2022-26488

high 7.0

In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable directories to the system search path. To exploit, an administrator must have installed Python for all users and enabled PATH entries. A non-administrative user can trigger a repair that incorrectly adds user-writable paths into PATH, enabling search-path hijacking of other users and system services. This affects Python (CPython) through 3.7.12, 3.8.x through 3.8.12, 3.9.x through 3.9.10, and 3.10.x through 3.10.2.

Open in the NVD CVE.org JSON

Details

Status
Modified
Published
Last changed
Source
cve@mitre.org
Weakness
CWE-426

Severity

VersionScoreVectorSource
CVSS 3.1 high 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H nvd@nist.govPrimary
CVSS 2.0 medium 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

  • python · python
  • netapp · active_iq_unified_manager
  • netapp · ontap_select_deploy_administration_utility

References