CVE-2023-39520

Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 allows local privilege escalation for low privileged users, via the repair function. The problem occurs as the repair function of the MSI is spawning an SYSTEM...

Code injection

Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 allows local privilege escalation for low privileged users, via the repair function. The problem occurs as the repair function of the MSI is spawning an SYSTEM...

CVE-2023-39520 Cryptomator vulnerable to Local Elevation of Privileges

Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 allows local privilege escalation for low privileged users, via the repair function. The problem occurs as the repair function of the MSI is spawning an SYSTEM...

CVE-2023-39520 Cryptomator vulnerable to Local Elevation of Privileges

Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 allows local privilege escalation for low privileged users, via the repair function. The problem occurs as the repair function of the MSI is spawning an SYSTEM...

CVE-2023-39520

CVE-2023-39520 affects Cryptomator. The MSI installer for version 1.9.2 spawns a SYSTEM PowerShell from the repair function, without using -NoProfile, causing the user’s profile to load and enabling local privilege escalation for low-privileged users. Version 1.9.3 includes a fix; a workaround is...

CVE-2023-39520 Cryptomator vulnerable to Local Elevation of Privileges

Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 allows local privilege escalation for low privileged users, via the repair function. The problem occurs as the repair function of the MSI is spawning an SYSTEM...

Cryptomator Security Breach

Cryptomator is a simple digital self-defense tool from the Cryptomator community. It is used to protect data. A security vulnerability exists in Cryptomator version 1.9.2, which stems from allowing low-privileged users to perform local privilege escalation via the REPAIR function...

PT-2023-26992 · Unknown · Cryptomator

Name of the Vulnerable Software and Affected Versions: Cryptomator version 1.9.2 Description: Cryptomator encrypts data being stored on cloud infrastructure. The issue allows local privilege escalation for low privileged users via the repair function. This occurs because the repair function of th...

CVE-2023-37907

Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation LPE for low privileged users, if already installed. The problem occurs as the repair function of the MSI spawn...

Code injection

Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation LPE for low privileged users, if already installed. The problem occurs as the repair function of the MSI spawn...

CVE-2023-37907 Cryptomator's MSI installer allows local privilege escalation

Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation LPE for low privileged users, if already installed. The problem occurs as the repair function of the MSI spawn...

CVE-2023-37907 Cryptomator's MSI installer allows local privilege escalation

Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation LPE for low privileged users, if already installed. The problem occurs as the repair function of the MSI spawn...

CVE-2023-37907

CVE-2023-37907 concerns Cryptomator and its MSI installer prior to version 1.9.2. The vulnerability arises because the MSI repair function spawns two administrative CMD processes, enabling a local privilege escalation for low-privileged users already with the software installed; a breakout can fa...

CVE-2023-37907 Cryptomator's MSI installer allows local privilege escalation

Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation LPE for low privileged users, if already installed. The problem occurs as the repair function of the MSI spawn...

PT-2023-26176 · Unknown · Cryptomator

Name of the Vulnerable Software and Affected Versions: Cryptomator versions prior to 1.9.2 Description: The issue affects data encryption software for cloud storage, allowing local privilege escalation for low-privileged users if the software is already installed. This occurs because the repair...

Cryptomator 安全漏洞

Cryptomator is a simple digital self-defense tool from the Cryptomator community. It is used to protect data. A security vulnerability exists in Cryptomator versions prior to 1.9.2, which stems from the MSI installer provided on the homepage allowing local privilege escalation for low privilege...

CVE-2022-25366

Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables entitlements. An attacker can exploit this by creating a malicious...

CVE-2022-25366

Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables entitlements. An attacker can exploit this by creating a malicious...

Command injection

Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables entitlements. An attacker can exploit this by creating a malicious...

CVE-2022-25366

Summary : CVE-2022-25366 affects Cryptomator up to v1.6.5 and earlier. The root cause is a DYLIB injection path: despite a Hardened Runtime flag, the app holds com.apple.security.cs.disable-library-validation and com.apple.security.cs.allow-dyld-environment-variables entitlements, enabling an att...