CVE-2021-25263

Опубликовано: 17 авг. 2021

Источник: nvd

CVSS3: 7.8

CVSS2: 4.6

EPSS Низкий

Описание

Local privilege vulnerability in Yandex Browser for Windows prior to 21.9.0.390 allows a local, low privileged, attacker to execute arbitary code with the SYSTEM privileges through manipulating files in directory with insecure permissions during Yandex Browser update process.

Ссылки

https://yandex.com/bugbounty/i/hall-of-fame-browser/
Vendor Advisory
https://yandex.com/bugbounty/i/hall-of-fame-browser/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:yandex:yandex_browser:*:*:*:*:*:windows:*:*

Версия до 21.9.0.390 (исключая)

EPSS

Процентиль: 27%

0.00096

Низкий

7.8 High

CVSS3

4.6 Medium

CVSS2

Дефекты

CWE-732

Связанные уязвимости

GHSA-37r4-xgj4-h786

CVSS3: 6.5

github

больше 3 лет назад

Clickhouse prior to versions v20.8.18.32-lts, v21.1.9.41-stable, v21.2.9.41-stable, v21.3.6.55-lts, v21.4.3.21-stable allows user to read any file on the host system, that clickhouse user has access to.

BDU:2022-02234