CVE-2021-44466

Bitmask Riseup VPN 0.21.6 contains a local privilege escalation flaw due to improper access controls

published December 30, 2021

CVSS
—
EPSS
0%
Percentile
32.9
In the wild
Unconfirmed
What it is

Bitmask Riseup VPN 0.21.6 contains a local privilege escalation flaw due to improper access controls. When the software is installed with a non-default installation directory off of the system root, the installer fails to properly set ACLs. This allows lower privileged users to replace the VPN executable with a malicious one. When a higher privileged user such as an Administrator launches that executable, it is possible for the lower privileged user to escalate to Administrator privileges.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00398 · 32.9th percentile
Published
2021-12-30T21:31Z
EPSS history
Timeline
  • 30 DEC 21:31Z
    Bitmask Riseup VPN 0.21.6 contains a local privilege escalation flaw due to improper access controls
    cvelistv5