CVE-2023-37907: cryptomator

csirt@kutim:~/threat-intel/cve/CVE-2023-37907

CVSS 7.8 · High EPSS 0,20%

Kerentanan Improper Privilege Management pada cryptomator. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation (LPE) for low privileged users, if already installed. The problem occurs as the repair function of the MSI spawns two administrative CMDs. A simple LPE is possible via a breakout. Version 1.9.2 fixes this issue.

Rincian

Terbit di NVD: 25 Juli 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-269: Improper Privilege Management
EPSS (30 hari): 0,20% peluang dieksploitasi; lebih tinggi dari 8,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
cryptomator	cryptomator	Semua versi sebelum 1.9.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/cryptomator/cryptomator/security/advisories/GHSA-9c9p-c3mg-hpjq exploit · issue tracking · advisory vendor
https://github.com/cryptomator/cryptomator/commit/b48ebd524b1626bf12ac98e35a7670b868fa208c patch
https://github.com/cryptomator/cryptomator/releases/tag/1.9.2 release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.