CVE-2002-0157 Nautilus 1.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the .nautilus-metafile.xml metadata file.

MediumCVSS 4.6 EPSS 0.35%

Published: 2003-04-02 08:00
Updated: 2026-06-17 00:56
Exploit status: No public exploit known

Sign in for asset impact Search another CVE

Description

Nautilus 1.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the .nautilus-metafile.xml metadata file.

Affected products

Product	Affected versions	Fixed in
eazel nautilus	= 1.0.4	No fix listed

References

20020502 R7-0003: Nautilus Symlink Vulnerability mailing-list patch vendor-advisory
nautilus-metafile-xml-symlink(8995) vdb-entry
RHSA-2002:064 vendor-advisory
4373 patch vdb-entry vendor-advisory

CVSS v2.0

4.6 Medium

AV:L/AC:L/Au:N/C:P/I:P/A:P

Access Vector: Local
Access Complexity: Low
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.35% (percentile 29.1)
CWE: Not classified

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.