Vulnerability · Published Dec 16, 2022 · Assigned by VulDB
CVE-2022-4563Freedom of the Press SecureDrop gpg-agent.conf symlink
High 7.8
In plain English
A high-severity security flaw in SecureDrop from Freedom of the Press. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Official description
A vulnerability was found in Freedom of the Press SecureDrop. It has been rated as critical. Affected by this issue is some unknown functionality of the file gpg-agent.conf. The manipulation leads to symlink following. Local access is required to approach this attack. The name of the patch is b0526a06f8ca713cce74b63e00d3730618d89691. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215972.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Freedom of the Press | SecureDrop | n/a |
Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H