112
Nature Type ID Name Page
ParentOf 64 Windows Shortcut Following (.LNK) 121
ParentOf 65 Windows Hard Link 123
ParentOf 1386 Insecure Operation on Windows Junction / Mount Point 2261
CanFollow 73 External Control of File Name or Path 132
CanFollow 363 Race Condition Enabling Link Following 897
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 706 Use of Incorrectly-Resolved Name or Reference 1544
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1019 Validate Inputs 2433
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1219 File Handling Issues 2480
Weakness Ordinalities
Resultant :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Operating_System : Windows (Prevalence = Sometimes)
Operating_System : Unix (Prevalence = Often)
Background Details
Soft links are a UNIX term that is synonymous with simple shortcuts on Windows-based platforms.
Alternate Terms
insecure temporary file : Some people use the phrase "insecure temporary file" when referring to
a link following weakness, but other weaknesses can produce insecure temporary files without any
symlink involvement at all.
Zip Slip : "Zip slip" is an attack that uses file archives (e.g., ZIP, tar, rar, etc.) that contain filenames
with path traversal sequences that cause the files to be written outside of the directory under which
the archive is expected to be extracted [REF-1282]. It is most commonly used for relative path
traversal (CWE-23) and link following (CWE-59).
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Access Control
Read Files or Directories
Modify Files or Directories
Bypass Protection Mechanism
An attacker may be able to traverse the file system to
unintended locations and read or overwrite the contents
of unexpected files. If the files are used for a security
mechanism then an attacker may be able to bypass the
mechanism.
Other Execute Unauthorized Code or Commands
CWE Version 4.14
CWE-59: Improper Link Resolution Before File Access ('Link Following')
CWE-59: Improper Link Resolution Before File Access ('Link Following')