CVE-2017-9270 HIGH

CVE-2017-9270: post-auth arbitrary file write on cryptctl server

Vendor Suse
Product cryptctl
Weakness CWE-22 · Path traversal
Published March 1, 2018
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

What the vulnerability does

01Description

In cryptctl before version 2.0 a malicious server could send RPC requests that could overwrite files outside of the cryptctl key database.

Key dates

02Disclosure timeline

March 1, 2018 CVE published
September 17, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-40518 ByteDance DeerFlow Path Traversal and Arbitrary File Write via Bootstrap Mode CVE-2026-24049 wheel Allows Arbitrary File Permission Modification via Path Traversal CVE-2021-35980 Adobe Acrobat Reader SpellDictionaryExport Path Traversal Remote Code Execution Vulnerability CVE-2026-9197 Smart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export CVE-2025-57753 vite-plugin-static-copy files not included in `src` are accessible with a crafted request