CVE-2013-6402 Path traversal in n/a

Low 2.1 Published 5 Jan 2014 Updated 6 Aug 2024

Local attackers can overwrite arbitrary files via symlink attacks on HPLIP temporary logs, potentially compromising system integrity.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2013-6402?

CVE-2013-6402 is a low-severity path traversal vulnerability in n/a, published on 5 Jan 2014. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.11 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hp-pkservice.log temporary file.

Weakness: CWE-59

Which versions are affected by CVE-2013-6402?

It affects 1 product.

Products include Hp Linux Imaging and Printing Project.

How do I fix CVE-2013-6402?

Apply the vendor's patch.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2013-6402 being exploited?

There is no known exploitation of CVE-2013-6402 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2013-6402, GHSA-6q8g-8jp7-r627.