{"id":"CVE-2022-1537","published":"2022-05-10T00:00:00Z","modified":"2024-08-03T00:10:03Z","title":"file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in…","vendor":"gruntjs","product":"gruntjs/grunt","tier":"tail","description":{"text":"file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00302,"percentile":0.22942,"provenance":"source"},"cwes":[{"id":"CWE-367","name":"Time-of-check Time-of-use (TOCTOU) Race Condition"}],"references":[{"url":"https://huntr.dev/bounties/0179c3e5-bc02-4fc9-8491-a1a319b51b4d","tags":[]},{"url":"https://github.com/gruntjs/grunt/commit/58016ffac5ed9338b63ecc2a63710f5027362bae","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2023/04/msg00006.html","tags":["mailing-list"]}],"priority":{"score":10.0,"factors":[{"name":"EPSS percentile","points":4.59},{"name":"CVSS severity","points":5.46}]},"vendorSlug":"gruntjs","affectedVersions":[{"vendor":"gruntjs","product":"gruntjs/grunt","versions":[">= unspecified, < 1.5.3"]}],"affected":[{"ecosystem":"npm","package":"grunt","vulnerableRanges":["<1.5.3"],"patched":["1.5.3"],"from":["GHSA-rm36-94g8-835r"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5193","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-7729","published":"2020-09-03","fixed":"1.3.0","kev":false},{"cve":"CVE-2022-0436","published":"2022-04-12","fixed":"1.5.2","kev":false,"link":{"from":"CVE-2022-0436","to":"CVE-2022-1537","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:grunt","fromFixed":"1.5.2","toFixed":"1.5.3","daysApart":28},{"kind":"similar","provenance":"machine","score":0.66,"basis":"same product + description similarity"}]}},{"cve":"CVE-2022-1537","published":"2022-05-10","fixed":"1.5.3","kev":false}],"package":"npm:grunt"}}