7
CVE-2020-14418
- EPSS 0.06%
- Veröffentlicht 30.01.2021 06:15:12
- Zuletzt bearbeitet 21.11.2024 05:03:13
- Quelle cve@mitre.org
- Teams Watchlist Login
- Unerledigt Login
A TOCTOU vulnerability exists in madCodeHook before 2020-07-16 that allows local attackers to elevate their privileges to SYSTEM. This occurs because path redirection can occur via vectors involving directory junctions.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Advanced Malware Protection Version < 7.2.13
Madshi ≫ Madcodehook Version < 4.1.3
Morphisec ≫ Unified Threat Prevention Platform Version < 3.5.9
Morphisec ≫ Unified Threat Prevention Platform Version >= 4.0 < 4.1.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.06% | 0.167 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7 | 1 | 5.9 |
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 6.9 | 3.4 | 10 |
AV:L/AC:M/Au:N/C:C/I:C/A:C
|
CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.