CVE-2023-37907 Cryptomator's MSI installer allows local privilege escalation

Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation LPE for low privileged users, if already installed. The problem occurs as the repair function of the MSI spawn...

CVE-2023-37907

CVE-2023-37907 concerns Cryptomator and its MSI installer prior to version 1.9.2. The vulnerability arises because the MSI repair function spawns two administrative CMD processes, enabling a local privilege escalation for low-privileged users already with the software installed; a breakout can fa...

CVE-2023-37907 Cryptomator's MSI installer allows local privilege escalation

Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation LPE for low privileged users, if already installed. The problem occurs as the repair function of the MSI spawn...

Cryptomator 安全漏洞

Cryptomator is a simple digital self-defense tool from the Cryptomator community. It is used to protect data. A security vulnerability exists in Cryptomator versions prior to 1.9.2, which stems from the MSI installer provided on the homepage allowing local privilege escalation for low privilege...

PT-2023-26176 · Unknown · Cryptomator

Name of the Vulnerable Software and Affected Versions: Cryptomator versions prior to 1.9.2 Description: The issue affects data encryption software for cloud storage, allowing local privilege escalation for low-privileged users if the software is already installed. This occurs because the repair...

CVE-2023-37907: Improper Privilege Management

Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation LPE for low privileged users, if already installed. The problem occurs as the repair function of the MSI spawn...

CVE-2022-25366

Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables entitlements. An attacker can exploit this by creating a malicious...

CVE-2022-25366

Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables entitlements. An attacker can exploit this by creating a malicious...

Command injection

Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables entitlements. An attacker can exploit this by creating a malicious...

CVE-2022-25366

Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables entitlements. An attacker can exploit this by creating a malicious...

CVE-2022-25366

Summary : CVE-2022-25366 affects Cryptomator up to v1.6.5 and earlier. The root cause is a DYLIB injection path: despite a Hardened Runtime flag, the app holds com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables entitlements, enabling an att...

CVE-2022-25366

Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables entitlements. An attacker can exploit this by creating a malicious...

CVE-2022-25366: Untrusted Search Path

Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables entitlements. An attacker can exploit this by creating a malicious...

Cryptomator 代码问题漏洞

Cryptomator is a simple digital self-defense tool from the Cryptomator community. It is used to protect data. Cryptomator suffers from a code issue vulnerability that stems from the fact that an attacker can exploit the vulnerability can exploit this by creating a malicious .dylib file that can b...

Cloud Client Side File Encryption: Cryptomator

Multi-platform transparent client-side encryption of your files in the cloud. Cryptomator provides transparent, client-side encryption for your cloud. Protect your documents from unauthorized access. Cryptomator is free and open source software, so you can rest assured there are no backdoors...