CVE-2012-2291

Severity: high (CVSS 7.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-01-21 · updated 2026-06-16
Weakness: CWE-264

Description

EMC Avamar Client 4.x, 5.x, and 6.x on HP-UX and Mac OS X, and the EMC Avamar plugin 4.x, 5.x, and 6.x for Oracle, uses world-writable permissions for cache directories, which allows local users to gain privileges via an unspecified symlink attack.

Affected products

EMC Avamar: 4.0, 4.1, 5.0, 5.0-sp1, 5.0-sp2, 5.0.0-407 (+2)
EMC Avamar Plugin: 4.0, 5.0, 6.0, 6.1

References

http://archives.neohapsis.com/archives/bugtraq/2013-01/0086.html
http://archives.neohapsis.com/archives/bugtraq/2013-01/0086.html

Get alerted when CVE-2012-2291 or the next vulnerability affects your stack