Local Privilege Escalation in cloudflared
CVE-2020-24356

6.4MEDIUM

Key Information:

Vendor

Cloudflare

Status
Cloudflared
Vendor
CVE Published:
2 October 2020

What is CVE-2020-24356?

cloudflared versions prior to 2020.8.1 contain a local privilege escalation vulnerability on Windows systems. When run on a Windows system, cloudflared searches for configuration files which could be abused by a malicious entity to execute commands as a privileged user. Version 2020.8.1 fixes this issue.

Affected Version(s)

cloudflared < 2020.8.1

References

https://github.com/cloudflare/cloudflared/security/adviso...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2020-24356 : Local Privilege Escalation in cloudflared