THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Fathom (Privacy friendly web analytics)
Zendesk (Helpdesk and Chat)

Ok

Home | EN
Support
CVE
PUBLISHED

CVE-2023-32175

VIPRE Antivirus Plus Link Following Local Privilege Escalation Vulnerability

Assignerzdi
Reserved2023-05-03
Published2024-05-03
Updated2024-07-05

Description

VIPRE Antivirus Plus Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Antivirus Plus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Anti Malware Service. By creating a symbolic link, an attacker can abuse the service to create arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18899.



HIGH: 7.8CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-59: Improper Link Resolution Before File Access ('Link Following')

Product status

Default status
unknown

11.0.6.22
affected

References

https://www.zerodayinitiative.com/advisories/ZDI-23-755/ (ZDI-23-755)

https://success.vipre.com/en_US/antivirus-plus-release-notes/home-plus-release-notes-20230530 (vendor-provided URL) vendor-advisory

cve.org CVE-2023-32175

nvd.nist.gov CVE-2023-32175

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2023-32175
© Copyright 2024 THREATINT. Made in Cyprus with +