CVE-2019-10197

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directories outside the share.

Metrics

CVSS 3.0 9.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Sep 3, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-101986.5An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were searched through find_re CVE-2019-101998.8It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use th CVE-2019-102007.2A flaw was discovered in OpenShift Container Platform 4 where, by default, users with access to create pods also have the ability to schedul CVE-2019-10200017.5yard before 0.9.20 allows path traversal.CVE-2019-10200027.5Pterodactyl before 0.7.14 with 2FA allows credential sniffing.CVE-2019-10200035.4invenio-records before 1.2.2 allows XSS.CVE-2019-10200047.5Tridactyl before 1.16.0 allows fake key events.CVE-2019-10200055.4invenio-communities before 1.0.0a20 allows XSS.CVE-2019-10200066.1invenio-app before 1.1.1 allows host header injection.CVE-2019-10200075.4Dependency-Track before 3.5.1 allows XSS.CVE-2019-10200086.1stacktable.js before 1.0.4 allows XSS.CVE-2019-10200097.5Fleet before 2.1.2 allows exposure of SMTP credentials.