Every CVESearch/Get API key

CVE-2019-13227

In GUI mode, deepin-clone before 1.1.3 creates a log file at the fixed path /tmp/.deepin-clone...

5.5 Medium

CVE-2019-13227 is a medium vulnerability (CVSS 5.5) in Deepin Deepin-clone, published July 4, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 39th percentile. No source names a fixed version.

What does this mean?
Severity
5.5 MediumCVSS 3.0, NVD
Exploit chance
0.44%EPSS, 39th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
No fix listedNo source names one

Description

In GUI mode, deepin-clone before 1.1.3 creates a log file at the fixed path /tmp/.deepin-clone.log as root, and follows symlinks there. An unprivileged user can prepare a symlink attack there to create or overwrite files in arbitrary file system locations. The content is not attacker controlled.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.44%Down 0.6 points since Apr 14, 2021
90%50%10%1%

Affected products

What each source reports

NVD Score used5.5

In GUI mode, deepin-clone before 1.1.3 creates a log file at the fixed path /tmp/.deepin-clone.log as root, and follows symlinks there. An unprivileged user can prepare a symlink attack there to create or overwrite files in arbitrary file system locations. The content is not attacker controlled.

Record
CVE-2019-13227
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
6.6 MediumAV:L/AC:L/Au:N/C:N/I:C/A:C
Weakness
CWE-59
Updated
2026-11-02
CVE ListNo score

In GUI mode, deepin-clone before 1.1.3 creates a log file at the fixed path /tmp/.deepin-clone.log as root, and follows symlinks there. An unprivileged user can prepare a symlink attack there to create or overwrite files in arbitrary file system locations. The content is not attacker controlled.

Record
CVE-2019-13227
Updated
2026-11-02
EUVDEUVD-2019-4740No score

In GUI mode, deepin-clone before 1.1.3 creates a log file at the fixed path /tmp/.deepin-clone.log as root, and follows symlinks there. An unprivileged user can prepare a symlink attack there to create or overwrite files in arbitrary file system locations. The content is not attacker controlled.

Record
EUVD-2019-4740
Updated
2026-11-03
GitHub AdvisoriesGHSA-v3m5-rr4q-j6rp5.5

In GUI mode, deepin-clone before 1.1.3 creates a log file at the fixed path /tmp/.deepin-clone...

In GUI mode, deepin-clone before 1.1.3 creates a log file at the fixed path /tmp/.deepin-clone.log as root, and follows symlinks there. An unprivileged user can prepare a symlink attack there to create or overwrite files in arbitrary file system locations. The content is not attacker controlled.

Record
GHSA-v3m5-rr4q-j6rp
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-59
Updated
2026-11-02
OSV5.5

In GUI mode, deepin-clone before 1.1.3 creates a log file at the fixed path /tmp/.deepin-clone.log as root, and follows symlinks there. An unprivileged user can prepare a symlink attack there to create or overwrite files in arbitrary file system locations. The content is not attacker controlled.

Record
CVE-2019-13227
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open