CWE Code: 59
Vulnerability Type: privilege_escalation
CVSS Score: 5.8
CWE Name:  Improper Link Resolution Before File Access ('Link Following')
Summary: an issue was discovered in cinnamon 1.9.2 through 3.8.6. the cinnamon-settings-users.py gui runs as root and allows configuration of (for example) other users' icon files in _on_face_browse_menuitem_activated and _on_face_menuitem_activated. these icon files are written to the respective user's $home/.face location. if an unprivileged user prepares a symlink pointing to an arbitrary location, then this location will be overwritten with the icon content.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): NONE/PARTIAL/PARTIAL
Published Date: 2018-07-02
Last Modified Date: 2018-09-04