CVE-2024-37391: Improper Neutralization of Special Elements used in an OS Command

ProtonVPN before 3.2.10 on Windows mishandles the drive installer path, which should use this: '"' + ExpandConstant'autopf\Proton\Drive' + '"' in Setup/setup.iss...

CVE-2024-37391

CVE-2024-37391 concerns ProtonVPN on Windows prior to version 3.2.10. The vulnerability stems from mishandling the drive installer path in Setup/setup.iss; the path should be created as the quoted ExpandConstant('{autopf}\Proton\Drive') to correctly locate the drive component. Affected software: ...

PT-2024-27517 · Proton · Protonvpn

Name of the Vulnerable Software and Affected Versions: ProtonVPN versions prior to 3.2.10 Description: The issue is related to the mishandling of the drive installer path in the Setup/setup.iss file. Specifically, it should use the path constructed by ' + ExpandConstant'autopfProtonDrive' + ' to...