Insecure Operation on Windows Junction/Mount Point Vulnerability
CVE-2023-32454

6.3MEDIUM

Key Information:

Vendor

Dell
Status
Dup Framework
Vendor
CVE Published:
6 February 2024

What is CVE-2023-32454?

The DUP framework versions up to and including 4.9.4.36 contain a vulnerability that allows local malicious users to exploit the system through insecure operations on Windows junctions and mount points. By manipulating these operations, an attacker can create arbitrary files, which may lead to service disruptions. This vulnerability highlights critical considerations for securing software environments and mitigating risks associated with local user permissions.

Affected Version(s)

DUP Framework 0 <= 4.9.4.36

References

https://www.dell.com/support/kbdoc/en-us/000216236/dsa-20...
vendor-advisory

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.