CVE-2010-3145

2010-08-2719:00:02

mitre

web.nvd.nist.gov

cve-2010-3145

untrusted search path

bitlocker drive encryption api

local privilege escalation

trojan horse

fveapi.dll

backup manager insecure library loading vulnerability

nvd

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

6.4

Confidence

Low

EPSS

0.97

Percentile

99.7%

JSON

Untrusted search path vulnerability in the BitLocker Drive Encryption API, as used in sdclt.exe in Backup Manager in Microsoft Windows Vista SP1 and SP2, allows local users to gain privileges via a Trojan horse fveapi.dll file in the current working directory, as demonstrated by a directory that contains a Windows Backup Catalog (.wbcat) file, aka “Backup Manager Insecure Library Loading Vulnerability.”

Affected configurations

Nvd

Node

microsoftwindows_vistasp1

microsoftwindows_vistasp2

VendorProductVersionCPE
microsoftwindows_vista*cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*
microsoftwindows_vista*cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*