CVE-2020-12431

Опубликовано: 21 мая 2020

Источник: nvd

CVSS3: 6.6

CVSS2: 6.3

EPSS Низкий

Описание

A Windows privilege change issue was discovered in Splashtop Software Updater before 1.5.6.16. Insecure permissions on the configuration file and named pipe allow for local privilege escalation to NT AUTHORITY/SYSTEM, by forcing a permission change to any Splashtop files and directories, with resultant DLL hijacking. This product is bundled with Splashtop Streamer (before 3.3.8.0) and Splashtop Business (before 3.3.8.0).

Ссылки

https://improsec.com/tech-blog/privilege-escalation-vulnerability-in-splashtop-streamer
Exploit
Third Party Advisory
https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/360042648231-Splashtop-Streamer-version-3-3-8-0-for-Windows-released-includes-SOS-version-3-3-8-0
Release Notes
Vendor Advisory
https://improsec.com/tech-blog/privilege-escalation-vulnerability-in-splashtop-streamer
Exploit
Third Party Advisory
https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/360042648231-Splashtop-Streamer-version-3-3-8-0-for-Windows-released-includes-SOS-version-3-3-8-0
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:splashtop:software_updater:*:*:*:*:*:*:*:*

Версия до 1.5.6.16 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:splashtop:streamer:*:*:*:*:-:windows:*:*

Версия до 3.3.8.0 (исключая)

cpe:2.3:a:splashtop:streamer:*:*:*:*:business:windows:*:*

Версия до 3.3.8.0 (исключая)

EPSS

Процентиль: 22%

0.00074

Низкий

6.6 Medium

CVSS3

6.3 Medium

CVSS2

Дефекты

CWE-732

Связанные уязвимости

GHSA-cmcx-h36r-grrw

github

больше 3 лет назад