CVE-2023-37907
Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation (LPE) for low privileged users, if already installed.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.20%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation (LPE) for low privileged users, if already installed. The problem occurs as the repair function of the MSI spawns two administrative CMDs. A simple LPE is possible via a breakout. Version 1.9.2 fixes this issue.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.20% probability · 9th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-269
- Affected
- cryptomator/cryptomator
- Source
- security-advisories@github.com
References
- https://github.com/cryptomator/cryptomator/commit/b48ebd524b1626bf12ac98e35a7670b868fa208cPatch
- https://github.com/cryptomator/cryptomator/releases/tag/1.9.2Release Notes
- https://github.com/cryptomator/cryptomator/security/advisories/GHSA-9c9p-c3mg-hpjqExploit, Issue Tracking, Vendor Advisory
- https://github.com/cryptomator/cryptomator/commit/b48ebd524b1626bf12ac98e35a7670b868fa208cPatch
- https://github.com/cryptomator/cryptomator/releases/tag/1.9.2Release Notes
- https://github.com/cryptomator/cryptomator/security/advisories/GHSA-9c9p-c3mg-hpjqExploit, Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.