CVE-2023-37907CWE-269

Cryptomator's MSI installer allows local privilege escalation

High · published July 25, 2023

CVSS v3.1
7.0
EPSS
0%
Percentile
8.8
In the wild
Unconfirmed
What it is

Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation (LPE) for low privileged users, if already installed. The problem occurs as the repair function of the MSI spawns two administrative CMDs. A simple LPE is possible via a breakout. Version 1.9.2 fixes this issue.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00196 · 8.8th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2023-07-25T20:11Z
EPSS history
Timeline
  • 25 JUL 20:11Z
    Cryptomator's MSI installer allows local privilege escalation
    cvelistv5