Arbitrary Modification Vulnerability in Avast Antivirus
CVE-2020-10865

7.5HIGH

Key Information:

Vendor

Avast

Status
Antivirus
Vendor
CVE Published:
1 April 2020

What is CVE-2020-10865?

A vulnerability in Avast Antivirus prior to version 20 enables attackers to exploit the aswTask RPC endpoint within the TaskEx library of the Avast Service (AvastSvc.exe). This exploitation allows for unauthorized modifications to the Components section of the Stats.ini file, potentially compromising the application's integrity and functionality when initiated from a Low Integrity process.

References

https://forum.avast.com/index.php?topic=232420.0
x_refsource_MISC
https://forum.avast.com/index.php?topic=232423.0
x_refsource_MISC
https://github.com/umarfarook882/Avast_Multiple_Vulnerabi...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.