CVE-2023-39520

Katalog CVE

CVSS 7.8 · High EPSS 0,33%

Kerentanan Improper Privilege Management pada cryptomator. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 allows local privilege escalation for low privileged users, via the `repair` function. The problem occurs as the repair function of the MSI is spawning an SYSTEM Powershell without the `-NoProfile` parameter. Therefore the profile of the user starting the repair will be loaded. Version 1.9.3 contains a fix for this issue. Adding a `-NoProfile` to the powershell is a possible workaround.

Rincian

Terbit di NVD

7 Agustus 2023

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cryptomator/cryptomator/security/advisories/GHSA-62gx-54j7-mjh3 exploit · mitigasi · advisory vendor
• https://github.com/cryptomator/cryptomator/commit/727c32ad50c3901a6144a11cf984a3b7ebcf8b2b patch
• https://github.com/cryptomator/cryptomator/releases/download/1.9.2/Cryptomator-1.9.2-x64.msi product
• https://github.com/cryptomator/cryptomator/releases/tag/1.9.3 release notes