What is the CVSS score of CVE-2013-2142?

CVE-2013-2142 has a CVSS 2.0 base score of 3.3 (Low). CVSS vector: AV:L/AC:M/Au:N/C:N/I:P/A:P. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2013-2142?

Yes, a public proof-of-concept exploit is available for CVE-2013-2142. Prioritise patching immediately. EPSS: 0.0%.

Libimobiledevice CVE-2013-2142

LOW

Improper Link Resolution Before File Access (CWE-59)

2014-01-19 secalert@redhat.com

Information Disclosure Libimobiledevice

3.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:L/AC:M/Au:N/C:N/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:L/AC:M/Au:N/C:N/I:P/A:P

Attack Vector

Local

Attack Complexity

Confidentiality

None

Integrity

Availability

Lifecycle Timeline

CVE Published

Jan 19, 2014 - 18:02 cve.org

LOW 3.3

DescriptionCVE.org

userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local users to overwrite arbitrary files via a symlink attack on (1) HostCertificate.pem, (2) HostPrivateKey.pem, (3) libimobiledevicerc, (4) RootCertificate.pem, or (5) RootPrivateKey.pem in /tmp/root/.config/libimobiledevice/.

AnalysisAI

userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local users to overwrite arbitrary files via a symlink attack on (1) HostCertificate.pem, (2). Rated low severity (CVSS 3.3). Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-59. userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local users to overwrite arbitrary files via a symlink attack on (1) HostCertificate.pem, (2) HostPrivateKey.pem, (3) libimobiledevicerc, (4) RootCertificate.pem, or (5) RootPrivateKey.pem in /tmp/root/.config/libimobiledevice/. Affected products include: Libimobiledevice.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.