What is the CVSS score of CVE-2014-0027?

CVE-2014-0027 has a CVSS 2.0 base score of 3.3 (Low). CVSS vector: AV:L/AC:M/Au:N/C:P/I:P/A:N. EPSS exploitation probability: 0.1%.

Flite CVE-2014-0027

LOW

Improper Link Resolution Before File Access (CWE-59)

2014-01-26 secalert@redhat.com

Information Disclosure Flite

3.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:L/AC:M/Au:N/C:P/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:L/AC:M/Au:N/C:P/I:P/A:N

Attack Vector

Local

Attack Complexity

Confidentiality

Integrity

Availability

None

Lifecycle Timeline

CVE Published

Jan 26, 2014 - 01:55 cve.org

LOW 3.3

DescriptionCVE.org

The play_wave_from_socket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tmp/awb.wav. NOTE: some of these details are obtained from third party information.

AnalysisAI

The play_wave_from_socket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tmp/awb.wav. Rated low severity (CVSS 3.3). No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-59. The play_wave_from_socket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tmp/awb.wav. NOTE: some of these details are obtained from third party information. Affected products include: Cmu Flite.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.