CVE-2017-20112

IVPN Client privileges management

CVSS 7.8 HIGHEPSS 0.4%CWE-269

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 7.8EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

29 jun 2022Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

A vulnerability has been found in IVPN Client 2.6.6120.33863 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument --up cmd leads to improper privilege management. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.6.2 is able to address this issue. It is recommended to upgrade the affected component.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Produtos afetados

IVPN · Client

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

http://seclists.org/fulldisclosure/2017/Feb/14 https://github.com/kacperszurek/exploits/blob/master/IVPN/ivpn_privilege_escalation.py https://vuldb.com/?id.96655