CVE-2020-15261

Katalog CVE

CVSS 6.7 · Medium EPSS 11,3%

Kerentanan Unquoted Search Path or Element pada veyon. Skor CVSS 3.1 6.7 (Medium) menurut NVD.

Deskripsi (NVD)

On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malicious executables with LocalSystem privileges. Since Veyon users (both students and teachers) usually don't have administrative privileges, this vulnerability is only dangerous in anyway unsafe setups. The problem has been fixed in version 4.4.2. As a workaround, the exploitation of the vulnerability can be prevented by revoking administrative privileges from all potentially untrustworthy users.

Rincian

Terbit di NVD

19 Oktober 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.7 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-428: Unquoted Search Path or Element

EPSS (30 hari)

11,3% peluang dieksploitasi; lebih tinggi dari 95,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/veyon/veyon/commit/f231ec511b9a09f43f49b2c7bb7c60b8046276b1 patch · advisory pihak ketiga
• http://packetstormsecurity.com/files/162873/Veyon-4.4.1-Unquoted-Service-Path.html exploit · advisory pihak ketiga · vdb entry
• https://github.com/veyon/veyon/issues/657 issue tracking · advisory pihak ketiga
• https://github.com/veyon/veyon/security/advisories/GHSA-c8cc-x786-hqqp advisory pihak ketiga
• https://www.exploit-db.com/exploits/48246 exploit · advisory pihak ketiga · vdb entry
• https://www.exploit-db.com/exploits/49925 exploit · advisory pihak ketiga · vdb entry