CVE-2020-6021CWE-427

Check Point Endpoint Security Client for Windows before version E84.20 allows write access to the directory from which the installation repair takes place

published December 3, 2020

CVSS
—
EPSS
0%
Percentile
21.9
In the wild
Unconfirmed
What it is

Check Point Endpoint Security Client for Windows before version E84.20 allows write access to the directory from which the installation repair takes place. Since the MS Installer allows regular users to run the repair, an attacker can initiate the installation repair and place a specially crafted DLL in the repair folder which will run with the Endpoint client’s privileges.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00304 · 21.9th percentile
Weakness
CWE-427 · Uncontrolled Search Path Element
Published
2020-12-03T13:31Z
EPSS history
Timeline
  • 03 DEC 13:31Z
    Check Point Endpoint Security Client for Windows before version E84.20 allows write access to the directory from which the installation repair takes place
    cvelistv5