Insecure Permissions in Avast Antivirus Sandbox Component
CVE-2021-45335

8.8HIGH

Key Information:

Vendor

Avast

Status
Antivirus
Vendor
CVE Published:
27 December 2021

What is CVE-2021-45335?

The Avast Antivirus software's sandbox component prior to version 20.4 is vulnerable due to an insecure permission setting. This vulnerability enables a local user to manipulate the results of scans, potentially allowing them to evade detection mechanisms or delete arbitrary files on the system. When exploited, this flaw can undermine the overall effectiveness of the antivirus protection, posing significant security risks for users.

References

https://www.avast.com/hacker-hall-of-fame/en/researcher-d...
x_refsource_MISC
https://github.com/the-deniss/Vulnerability-Disclosures/t...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2021-45335 : Insecure Permissions in Avast Antivirus Sandbox Component