Windows Shortcut Following (.LNK)
CWE-64
The product, when opening a file or directory, does not sufficiently handle when the file is a Windows shortcut (.LNK) whose target is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
We track 5 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.4.
How this weakness is prevented
- Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Latest Windows Shortcut Following (.LNK) vulnerabilities
- 7.8 High severity
Trend Micro Cleaner One Pro: Windows Shortcut Following (.LNK)
Trend Micro Cleaner One Pro is vulnerable to a Privilege Escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.
- 7.8 High severity
Trend Micro Password Manager: Improper Link Resolution Before File Access
Trend Micro Password Manager (Consumer) version 5.8.0.1327 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow an attacker the opportunity to abuse symbolic links and other methods to delete any file/folder and achie
- 7.1 High severity
Trend Micro Security (Consumer): Windows Shortcut Following (.LNK)
Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.
- 7.1 High severity
Trend Micro Internet Security (Consumer): Windows Shortcut Following (.LNK)
Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.
- 7.1 High severity
Trend Micro Internet Security (Consumer): Windows Shortcut Following (.LNK)
Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.