CVE-2021-30359

Опубликовано: 22 окт. 2021

Источник: nvd

CVSS3: 7.8

CVSS2: 7.2

EPSS Низкий

Описание

The Harmony Browse and the SandBlast Agent for Browsers installers must have admin privileges to execute some steps during the installation. Because the MS Installer allows regular users to repair their installation, an attacker running an installer before 90.08.7405 can start the installation repair and place a specially crafted binary in the repair folder, which runs with the admin privileges.

Ссылки

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/MNDT-2021-0007/MNDT-2021-0007.md
Third Party Advisory
https://supportcontent.checkpoint.com/solutions?id=sk175968
Vendor Advisory
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/MNDT-2021-0007/MNDT-2021-0007.md
Third Party Advisory
https://supportcontent.checkpoint.com/solutions?id=sk175968
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:a:checkpoint:harmony_browse:*:*:*:*:*:*:*:*

Версия до 90.08.7405 (исключая)

cpe:2.3:a:checkpoint:sandblast_agent_for_browsers:*:*:*:*:*:*:*:*

Версия до 90.08.7405 (исключая)

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

EPSS

Процентиль: 19%

0.00061

Низкий

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-427

Связанные уязвимости

GHSA-5r3w-7crg-r9gw

github

больше 3 лет назад