7.8

CVE-2023-49147

Exploit

EPSS 0.08%
Veröffentlicht 19.12.2023 23:15:07
Zuletzt bearbeitet 21.11.2024 08:32:55
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

An issue was discovered in PDF24 Creator 11.14.0. The configuration of the msi installer file was found to produce a visible cmd.exe window when using the repair function of msiexec.exe. This allows an unprivileged local attacker to use a chain of actions (e.g., an oplock on faxPrnInst.log) to open a SYSTEM cmd.exe.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 6

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Pdf24 ≫ Pdf24 Creator Version < 11.15.2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.08%	0.238

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Es wurden noch keine Informationen zu CWE veröffentlicht.

http://packetstormsecurity.com/files/176206/PDF24-Creator-11.15.1-Local-Privilege-Escalation.html

Third Party Advisory

Exploit

VDB Entry

http://seclists.org/fulldisclosure/2023/Dec/18

Third Party Advisory

Exploit

Mailing List

https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-via-msi-installer-in-pdf24-creator-geek-software-gmbh/

Third Party Advisory

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2023-49147

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-49147

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-49147

EUVD