by Kastro
Paper/Archive/CVE-2020-13542

CVE-2020-13542

talos — A local privilege elevation vulnerability exists in the file system permissions of LogicalDoc 8.5.1 installation.

EPSS 0.6%CVSS 9.3
critical.is priorityof 100
38
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 49.3.493 × 209.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A local privilege elevation vulnerability exists in the file system permissions of LogicalDoc 8.5.1 installation. Depending on the vector chosen, an attacker can either replace the service binary or replace DLL files loaded by the service, both which get executed by a service thus executing arbitrary commands with System privileges.

Affected

ProductAffectedFixed inSource
LogicalDocLogicalDoc 8.5.1–CNA

Scores by source

talos (CNA)9.3CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

reftalosintelligence.com/vulnerability_reports/TALOS-2020-1154