CVE-2020-12613
An attacker can spawn a process with multiple users as part of the security token (prior to Avecto elevation).
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.77%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. An attacker can spawn a process with multiple users as part of the security token (prior to Avecto elevation). When Avecto elevates the process, it removes the user who is launching the process, but not the second user. Therefore this second user still retains access and can give permission to the process back to the first user.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.77% probability · 54th percentile
- CISA KEV
- Not listed
- Affected
- beyondtrust/privilege management for windows
- Source
- cve@mitre.org
References
- https://www.beyondtrust.com/support/changelog/privilege-management-for-windows-5-6-sr1Release Notes
- https://www.beyondtrust.com/trust-center/security-advisories/bt22-11Vendor Advisory
- https://www.beyondtrust.com/support/changelog/privilege-management-for-windows-5-6-sr1Release Notes
- https://www.beyondtrust.com/trust-center/security-advisories/bt22-11Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.