CVE-2020-15264

Katalog CVE

CVSS 7.8 · High EPSS 1,6%

Kerentanan External Control of File Name or Path pada chocolatey boxstarter. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

The Boxstarter installer before version 2.13.0 configures C:\ProgramData\Boxstarter to be in the system-wide PATH environment variable. However, this directory is writable by normal, unprivileged users. To exploit the vulnerability, place a DLL in this directory that a privileged service is looking for. For example, WptsExtensions.dll When Windows starts, it'll execute the code in DllMain() with SYSTEM privileges. Any unprivileged user can execute code with SYSTEM privileges. The issue is fixed in version 3.13.0

Rincian

Terbit di NVD

20 Oktober 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-73: External Control of File Name or Path
CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 74,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/chocolatey/boxstarter/commit/67e320491813550b48900e87105a34ceefdcf633 patch · advisory pihak ketiga
• https://github.com/chocolatey/boxstarter/security/advisories/GHSA-rpgx-h675-r3jf advisory pihak ketiga
• https://www.kb.cert.org/vuls/id/208577 advisory pihak ketiga