CVE-2022-32450

Опубликовано: 18 июл. 2022

Источник: nvd

CVSS3: 7.1

EPSS Низкий

Описание

AnyDesk 7.0.9 allows a local user to gain SYSTEM privileges via a symbolic link because the user can write to their own %APPDATA% folder (used for ad.trace and chat) but the product runs as SYSTEM when writing chat-room data there.

Ссылки

http://anydesk.com
Vendor Advisory
http://packetstormsecurity.com/files/167608/AnyDesk-7.0.9-Arbitrary-File-Write-Denial-Of-Service.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2022/Jul/9
Exploit
Mailing List
Third Party Advisory
https://seclists.org/fulldisclosure/2022/Jun/44
Exploit
Mailing List
Third Party Advisory
http://anydesk.com
Vendor Advisory
http://packetstormsecurity.com/files/167608/AnyDesk-7.0.9-Arbitrary-File-Write-Denial-Of-Service.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2022/Jul/9
Exploit
Mailing List
Third Party Advisory
https://seclists.org/fulldisclosure/2022/Jun/44
Exploit
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:anydesk:anydesk:7.0.9:*:*:*:*:*:*:*

EPSS

Процентиль: 31%

0.0012

Низкий

7.1 High

CVSS3

Дефекты

CWE-59

Связанные уязвимости

GHSA-32r7-mgwg-67wq