CVE-2020-11613
Mids' Reborn Hero Designer 2.6.0.7 has an elevation of privilege vulnerability due to default and insecure permissions being set for the installation folder.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.46%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Mids' Reborn Hero Designer 2.6.0.7 has an elevation of privilege vulnerability due to default and insecure permissions being set for the installation folder. By default, the Authenticated Users group has Modify permissions to the installation folder. Because of this, any user on the system can replace binaries or plant malicious DLLs to obtain elevated, or different, privileges, depending on the context of the user that runs the application.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 0.46% probability · 39th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-427, CWE-732
- Affected
- mids\' reborn hero designer project/mids\' reborn hero designer
- Source
- cve@mitre.org
References
- https://github.com/Crytilis/mids-reborn-hero-designer/releasesRelease Notes, Third Party Advisory
- https://www.doyler.net/security-not-included/mids-reborn-vulnerabilitiesExploit, Third Party Advisory
- https://github.com/Crytilis/mids-reborn-hero-designer/releasesRelease Notes, Third Party Advisory
- https://www.doyler.net/security-not-included/mids-reborn-vulnerabilitiesExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.