High severity · published Mar 17, 2022
CVE-2022-26526
Anaconda Anaconda3 (Anaconda Distribution) through 2021.11.0.0 and Miniconda3 through 4.11.0.0 can create a world-writable directory under %PROGRAMDATA% and place that directory…
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
Anaconda Anaconda3 (Anaconda Distribution) through 2021.11.0.0 and Miniconda3 through 4.11.0.0 can create a world-writable directory under %PROGRAMDATA% and place that directory into the system PATH environment variable. Thus, for example, local users can gain privileges by placing a Trojan horse file into that directory. (This problem can only happen in a non-default installation. The person who installs the product must specify that it is being installed for all users. Also, the person who installs the product must specify that the system PATH should be changed.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Anaconda3 · Anaconda
through 2021.11.0.0 · source: NVD
MI
Miniconda3 · Conda
through 4.11.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-26526
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-26526
Product
https://docs.conda.io/en/latest/miniconda.html
Issue Tracking
https://github.com/continuumio/anaconda-issues/issues
Exploit
https://improsec.com/tech-blog/privilege-escalation-vulnerability-in-anaconda3-and-miniconda3
Vendor Advisory
https://repo.anaconda.com/miniconda/
More from Anaconda3
8.8
CVE-2021-42969
Certain Anaconda3 2021.05 are affected by OS command injection
7.8
CVE-2024-46060
Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home directory
4.7
CVE-2023-35845
Anaconda 3 2023.03-1-Linux allows local users to disrupt TLS certificate validation by modifying the cacert.pem file used by the installed pip program