Cryptomator vulnerable to Local Elevation of Privileges
CVE-2023-39520

7.8HIGH

Key Information:

Vendor

Cryptomator

Status
Cryptomator
Vendor
CVE Published:
7 August 2023

What is CVE-2023-39520?

A vulnerability in Cryptomator's 1.9.2 MSI installer allows local privilege escalation due to the repair function spawning an elevated PowerShell instance without the '-NoProfile' parameter. This oversight leads to the loading of the attacker's user profile, potentially allowing them to execute malicious commands with elevated privileges. Users are advised to upgrade to version 1.9.3 or implement a workaround by modifying PowerShell command parameters.

Affected Version(s)

cryptomator <= 1.9.2

References

https://github.com/cryptomator/cryptomator/security/advis...
x_refsource_CONFIRM
https://github.com/cryptomator/cryptomator/commit/727c32a...
x_refsource_MISC
https://github.com/cryptomator/cryptomator/releases/downl...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.