CVE Daily

CVE-2009-4411

The (1) setfacl and (2) getfacl commands in XFS acl 2.2.47, when running in recu...

Low CVSS 3.7

Overview

The (1) setfacl and (2) getfacl commands in XFS acl 2.2.47, when running in recursive (-R) mode, follow symbolic links even when the --physical (aka -P) or -L option is specified, which might allow local users to modify the ACL for arbitrary files or directories via a symlink attack.

CWE: CWE-264 Published: 2009-12-24T16:30:00.343
Risk analysis

This vulnerability is rated 🟢 LOW.

  • CVSS: 3.7 (LOW)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags