CVE-2022-27535

Kaspersky VPN Secure Connection for Windows version up to 21.5 was vulnerable to arbitrary file deletion via abuse of its 'Delete All Service Data And Reports' feature by the local authenticated attacker.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://forum.kaspersky.com/topic/kaspersky-statement-on-cve-2022-27535-26742/	Vendor Advisory
https://support.kaspersky.com/general/vulnerability.aspx?el=12430#050822	Vendor Advisory
https://www.synopsys.com/blogs/software-security/cyrc-advisory-kasperksy-vpn-microsoft-windows/	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:kaspersky:vpn_secure_connection:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-08-05 17:15

Updated : 2024-02-28 19:29

NVD link : CVE-2022-27535

Mitre link : CVE-2022-27535

CVE.ORG link : CVE-2022-27535

JSON object : View

Products Affected

kaspersky

vpn_secure_connection

microsoft

windows

CWE

NVD-CWE-noinfo

{"id": "CVE-2022-27535", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2022-08-05T17:15:08.403", "references": [{"url": "https://forum.kaspersky.com/topic/kaspersky-statement-on-cve-2022-27535-26742/", "tags": ["Vendor Advisory"], "source": "vulnerability@kaspersky.com"}, {"url": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#050822", "tags": ["Vendor Advisory"], "source": "vulnerability@kaspersky.com"}, {"url": "https://www.synopsys.com/blogs/software-security/cyrc-advisory-kasperksy-vpn-microsoft-windows/", "tags": ["Third Party Advisory"], "source": "vulnerability@kaspersky.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Kaspersky VPN Secure Connection for Windows version up to 21.5 was vulnerable to arbitrary file deletion via abuse of its 'Delete All Service Data And Reports' feature by the local authenticated attacker."}, {"lang": "es", "value": "La versi\u00f3n de Kaspersky VPN Secure Connection para Windows hasta la 21.5 era vulnerable a la eliminaci\u00f3n arbitraria de archivos a trav\u00e9s del abuso de su funci\u00f3n \"Eliminar todos los datos e informes de servicio\" por parte de un atacante local autenticado"}], "lastModified": "2022-08-15T23:05:57.977", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kaspersky:vpn_secure_connection:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CDFF1742-6E6F-405D-8623-7636F154156B", "versionEndExcluding": "21.6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "vulnerability@kaspersky.com"}