Lucene search

VulDBCVELIST:CVE-2017-20112

HistoryJun 29, 2022 - 6:55 a.m.

CVE-2017-20112 IVPN Client privileges management

2022-06-2906:55:42

CWE-269

VulDB

www.cve.org

ivpn client

privilege management

vulnerability

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

30.6%

JSON

A vulnerability has been found in IVPN Client 2.6.6120.33863 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument --up cmd leads to improper privilege management. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.6.2 is able to address this issue. It is recommended to upgrade the affected component.

CNA Affected

[
  {
    "product": "Client",
    "vendor": "IVPN",
    "versions": [
      {
        "status": "affected",
        "version": "2.6.6120.33863"
      }
    ]
  }
]

References

seclists.org/fulldisclosure/2017/Feb/14

github.com/kacperszurek/exploits/blob/master/IVPN/ivpn_privilege_escalation.py

vuldb.com/?id.96655

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

30.6%

JSON

Related for CVELIST:CVE-2017-20112