CVE-2022-23909

Опубликовано: 05 апр. 2022

Источник: nvd

CVSS3: 7.8

CVSS2: 7.2

EPSS Низкий

Описание

There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This might allow a local user to escalate privileges by creating a "C:\Program Files\Sherpa Software\Sherpa.exe" file.

Ссылки

http://packetstormsecurity.com/files/166574/Sherpa-Connector-Service-2020.2.20328.2050-Unquoted-Service-Path.html
Exploit
Third Party Advisory
VDB Entry
https://github.com/netsectuna/CVE-2022-23909
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/166574/Sherpa-Connector-Service-2020.2.20328.2050-Unquoted-Service-Path.html
Exploit
Third Party Advisory
VDB Entry
https://github.com/netsectuna/CVE-2022-23909
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:gimmal:sherpa_connector_service:2020.2.20328.2050:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

EPSS

Процентиль: 44%

0.00216

Низкий

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-428

Связанные уязвимости

GHSA-634r-5wp4-57x4