Executive Summary

This vulnerability exists in Dragonfly2 versions prior to 2.1.0, where the software uses the os.MkdirAll function to create directories without checking permissions if the directory already exists. A local attacker can exploit this by pre-creating a directory with broad permissions that Dragonfly2 will later use, potentially allowing the attacker to tamper with files within that directory.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow a local attacker to tamper with files used by Dragonfly2 by exploiting the directory creation process. This could lead to unauthorized modification of files, potentially compromising the integrity of the system or data managed by Dragonfly2.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade DragonFly2 to version 2.1.0 or later, as this version contains the fix for the vulnerability related to directory creation permissions.

Useful 0 Not Useful 0