5.3

CVE-2020-5147

Exploit
SonicWall NetExtender Windows client vulnerable to unquoted service path vulnerability, this allows a local attacker to gain elevated privileges in the host operating system. This vulnerability impact SonicWall NetExtender Windows client version 10.2.300 and earlier.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sonicwall ≫ Netextender SwPlatform windows Version <= 10.2.300
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.66% 0.736
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.3 1.8 3.4
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
NIST 4.6 3.9 6.4
AV:L/AC:L/Au:N/C:P/I:P/A:P
CWE-428 Unquoted Search Path or Element

The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.

http://packetstormsecurity.com/files/163857/SonicWall-NetExtender-10.2.0.300-Unquoted-Service-Path.html
Third Party Advisory
Exploit
VDB Entry
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0023
Vendor Advisory