CVE-2021-28153: broadcom brocade_fabric_operating_system_firmware Link Following

Vulnerability summary

CVE-2021-28153 is a medium (CVSS 5.3) Link Following vulnerability in broadcom brocade_fabric_operating_system_firmware. EPSS estimates a 2.71% chance of exploitation in the next 30 days, higher than 85.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 11-03-2021
   PublishedVulnerability first disclosed.
2. 14-10-2026
   Last modifiedVulnerability information updated.

Description

An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)

• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.