VULNERABILITY INTELLIGENCE
CVE-2014-5029
CVSS score1.5 LOW
EPSS probability0.32%
CISA KEVNot currently listed
Published2014-07-29
Last modified2026-06-17
CVSS vectorAV:L/AC:M/Au:S/C:P/I:N/A:N
Description
The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language[0] set to null. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537.
Weakness classification
- CWE-59: Improper Link Resolution Before File Access ('Link Following')