CVE-2019-10220

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
SUSE	kernel:	kernel version 4.9.0

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10220Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00013.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00001.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20200103-0001/Third Party Advisory
https://usn.ubuntu.com/4226-1/Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10220Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00013.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/03/msg00001.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20200103-0001/Third Party Advisory
https://usn.ubuntu.com/4226-1/Third Party Advisory

Timeline

Published: Nov 27, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-102216.1A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. CVE-2019-102227.5A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated attacker could crash CVE-2019-102236.5A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 releas CVE-2019-102244.6A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may di CVE-2019-102256.3A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently pr CVE-2019-102265.4HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOT CVE-2019-102276.1openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.CVE-2019-102298.8An issue was discovered in MailStore Server (and Service Provider Edition) 9.x through 11.x before 11.2.2. When the directory service (for s CVE-2019-10236.5An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge. An at CVE-2019-102319.8Teclib GLPI before 9.4.1.1 is affected by a PHP type juggling vulnerability allowing bypass of authentication. This occurs in Auth::checkPas CVE-2019-102329.8Teclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlock_tasks.php.CVE-2019-102338.1Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie.