by Kastro
Paper/Archive/CVE-2022-25643

CVE-2022-25643

mitre — seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root.

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 81.7.817 × 2016.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgithub.com/kennylevinsen/seatd/tagsrefgithub.com/kennylevinsen/seatd/compare/0.6.3...0.6.4reflists.sr.ht/~kennylevinsen/seatd-announce/%3CETEO7R.QG8B1KGD531R1%40kl.wtf%3Erefgithub.com/kennylevinsen/seatd/commit/10658dc5439db429af0088295a051c53925a4416refgithub.com/kennylevinsen/seatd/commit/7cffe0797fdb17a9c08922339465b1b187394335refnvd.nist.gov/vuln/detail/CVE-2022-25643