CVE-2024-45315

Improper Link Resolution Before File Access ('Link Following') (CWE-59)

Published: Oct 11, 2024 / Updated: 39d ago

- The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlier of Windows client) allows users with standard privileges to create arbitrary folders and files, potentially leading to local Denial of Service (DoS) attack. - The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlier of Windows client) allows users with standard privileges to delete arbitrary folders and files, potentially leading to local privilege escalation attack.

Development Last Updated: 10/17/2024 CVEs: CVE-2024-45315 , CVE-2024-45316

In the connect tunnel client of the SMA1000 appliances, another "link following" vulnerability allows users with standard rights to create arbitrary files and folders and thus trigger a denial of service (CVE-2024-45315, CVSS 6.1, medium ). Sonicwall warns of security vulnerabilities in SSL VPN appliances of the SMA1000 series and the Connect Tunnel Client for Windows.

For more information on Vulnerability Patches, Please refer to the “FIXED SOFTWARE” section of the product-specific Referenced Sites document. The following product-specific Vulnerability Patches were made available with the October 10, 2024 update.

Medium Severity Description The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlier of Windows client) allows users with standard privileges to create arbitrary folders and files, potentially leading to local Denial of Service (DoS) attack. Read more at https://www.tenable.com/cve/CVE-2024-45315