Cryptomator vulnerable to Local Elevation of Privileges
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.5epss 0.3%
probabilidade de exploração
0.3%top 74% das CVEs
exploração observada
nãonenhuma fonte reporta
Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 allows local privilege escalation for low privileged users, via the `repair` function. The problem occurs as the repair function of the MSI is spawning an SYSTEM Powershell without the `-NoProfile` parameter. Therefore the profile of the user starting the repair will be loaded. Version 1.9.3 contains a fix for this issue. Adding a `-NoProfile` to the powershell is a possible workaround.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
cryptomator · cryptomatorReferências
https://github.com/cryptomator/cryptomator/commit/727c32ad50c3901a6144a11cf984a3b7ebcf8b2bhttps://github.com/cryptomator/cryptomator/releases/download/1.9.2/Cryptomator-1.9.2-x64.msihttps://github.com/cryptomator/cryptomator/releases/tag/1.9.3https://github.com/cryptomator/cryptomator/security/advisories/GHSA-62gx-54j7-mjh3