Symlink Vulnerability in Private Tunnel for macOS
CVE-2020-15076

7.8HIGH

Key Information:

Vendor
Openvpn
Status
Private Tunnel
Vendor
CVE Published:
26 May 2021

Summary

The Private Tunnel installer for macOS prior to version 3.0.1 is susceptible to a symlink vulnerability that allows it to access and potentially corrupt critical system files located in the /tmp directory. This flaw can lead to unintended alterations of important files, compromising system integrity and user data. Users of the affected versions are strongly advised to upgrade to the latest version to mitigate these risks.

Affected Version(s)

Private Tunnel 3.0.1 and prior versions

References

https://swupdate.openvpn.net/downloads/privatetunnel/chan...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.