CVE-2018-20341

WINMAGIC SecureDoc Disk Encryption software before 8.3 has an Unquoted Service Path vulnerability, which could allow an attacker to execute arbitrary code on a target system. If the executable is enclosed in quote tags "" then the system will know where to find it. However if the path of where the application binary is located doesn't contain any quotes then Windows will try to find it and execute it inside every folder of this path until they reach the executable.

CVSS v3 7.8 HIGH
CVSS v2.0 4.6 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://downloads.winmagic.info/manuals/Release_Notes_8.3.pdf	Release Notes Vendor Advisory
http://downloads.winmagic.info/manuals/Release_Notes_8.3.pdf	Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:winmagic:securedoc_disk_encryption:*:*:*:*:*:*:*:*

History

21 Nov 2024, 04:01

Type	Values Removed	Values Added
References	~~() http://downloads.winmagic.info/manuals/Release_Notes_8.3.pdf - Release Notes, Vendor Advisory~~	() http://downloads.winmagic.info/manuals/Release_Notes_8.3.pdf - Release Notes, Vendor Advisory

Information

Published : 2019-04-08 15:29

Updated : 2024-11-21 04:01

NVD link : CVE-2018-20341

Mitre link : CVE-2018-20341

CVE.ORG link : CVE-2018-20341

JSON object : View

Products Affected

winmagic

securedoc_disk_encryption

CWE

CWE-428

Unquoted Search Path or Element

{"id": "CVE-2018-20341", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2019-04-08T15:29:01.060", "references": [{"url": "http://downloads.winmagic.info/manuals/Release_Notes_8.3.pdf", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://downloads.winmagic.info/manuals/Release_Notes_8.3.pdf", "tags": ["Release Notes", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-428"}]}], "descriptions": [{"lang": "en", "value": "WINMAGIC SecureDoc Disk Encryption software before 8.3 has an Unquoted Service Path vulnerability, which could allow an attacker to execute arbitrary code on a target system. If the executable is enclosed in quote tags \"\" then the system will know where to find it. However if the path of where the application binary is located doesn't contain any quotes then Windows will try to find it and execute it inside every folder of this path until they reach the executable."}, {"lang": "es", "value": "El programa WINMAGIC SecureDoc Disk Encryption anterior a versi\u00f3n 8.3 tiene una vulnerabilidad de tipo Unquoted Service Path, que podr\u00eda permitir a un atacante ejecutar c\u00f3digo arbitrario en un sistema de destino. Si el ejecutable est\u00e1 encerrado en las etiquetas de comillas \"\", el sistema sabr\u00e1 d\u00f3nde encontrarlo. Sin embargo, si el path donde se ubica el binario de la aplicaci\u00f3n no contiene ninguna cita, Windows intentar\u00e1 encontrarla y ejecutarla dentro de cada carpeta de esta ruta hasta que llegue al ejecutable."}], "lastModified": "2024-11-21T04:01:16.620", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:winmagic:securedoc_disk_encryption:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DD61E50A-8156-481B-8334-EEC8EB62E449", "versionEndExcluding": "8.3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}