Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-v6gp-395w-jvcw

Опубликовано: 20 авг. 2023
Источник: github
Github: Не прошло ревью
CVSS3: 7

Описание

Unity Parsec before 8 has a TOCTOU race condition that permits local attackers to escalate privileges to SYSTEM if Parsec was installed in "Per User" mode. The application intentionally launches DLLs from a user-owned directory but intended to always perform integrity verification of those DLLs.

Unity Parsec before 8 has a TOCTOU race condition that permits local attackers to escalate privileges to SYSTEM if Parsec was installed in "Per User" mode. The application intentionally launches DLLs from a user-owned directory but intended to always perform integrity verification of those DLLs.

EPSS

Процентиль: 30%
0.00111
Низкий

7 High

CVSS3

Дефекты

CWE-367

Связанные уязвимости

CVSS3: 7
nvd
больше 2 лет назад

Unity Parsec has a TOCTOU race condition that permits local attackers to escalate privileges to SYSTEM if Parsec was installed in "Per User" mode. The application intentionally launches DLLs from a user-owned directory but intended to always perform integrity verification of those DLLs. This affects Parsec Loader versions through 8. Parsec Loader 9 is a fixed version.

EPSS

Процентиль: 30%
0.00111
Низкий

7 High

CVSS3

Дефекты

CWE-367