7.8

CVE-2020-26155

Exploit
Multiple files and folders in Utimaco SecurityServer 4.20.0.4 and 4.31.1.0. are installed with Read/Write permissions for authenticated users, which allows for binaries to be manipulated by non-administrator users. Additionally, entries are made to the PATH environment variable which, in conjunction with these weak permissions, could enable an attacker to perform a DLL hijacking attack.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Utimaco ≫ Block-safe Firmware Version2.0.0
   Microsoft ≫ Windows Version-
Utimaco ≫ Block-safe Firmware Version3.0.0
   Microsoft ≫ Windows Version-
Utimaco ≫ Cryptoserver Cp5 Firmware Version5.0.0.0
   Microsoft ≫ Windows Version-
Utimaco ≫ Cryptoserver Cp5 Firmware Version5.1.0.0
   Microsoft ≫ Windows Version-
Utimaco ≫ Cryptoserver Cp5 Vs-nfd Firmware Version5.1.0.0
   Microsoft ≫ Windows Version-
Utimaco ≫ Paymentserver Firmware Version >= 3.0 <= 4.31.0
   Microsoft ≫ Windows Version-
Utimaco ≫ Paymentserver Hybrid Firmware Version >= 3.0 <= 4.33.0
   Microsoft ≫ Windows Version-
Utimaco ≫ Securityserver Firmware Version >= 3.0 <= 4.31.1
   Microsoft ≫ Windows Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.04% 0.091
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov 4.4 3.4 6.4
AV:L/AC:M/Au:N/C:P/I:P/A:P
CWE-427 Uncontrolled Search Path Element

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.