Windscribe Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Windscribe. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the Windscribe Service. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23441.
References
Link | Resource |
---|---|
https://github.com/Windscribe/Desktop-App/blob/90a5cc3c1f50f6545f83969c2ace6b4ac2c91c4e/client/common/changelog.txt#L23 | Release Notes |
https://www.zerodayinitiative.com/advisories/ZDI-24-820/ | Third Party Advisory VDB Entry |
Configurations
History
23 Aug 2024, 16:53
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
|
First Time |
Windscribe
Windscribe windscribe |
|
CPE | cpe:2.3:a:windscribe:windscribe:2.9.9:*:*:*:*:windows:*:* | |
References | () https://github.com/Windscribe/Desktop-App/blob/90a5cc3c1f50f6545f83969c2ace6b4ac2c91c4e/client/common/changelog.txt#L23 - Release Notes | |
References | () https://www.zerodayinitiative.com/advisories/ZDI-24-820/ - Third Party Advisory, VDB Entry |
21 Aug 2024, 17:24
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-08-21 17:15
Updated : 2024-08-23 16:53
NVD link : CVE-2024-6141
Mitre link : CVE-2024-6141
CVE.ORG link : CVE-2024-6141
JSON object : View
Products Affected
windscribe
- windscribe
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')