CVE-2024-4461CWE-428

Unquoted path or search item vulnerability in SugarSync

High · published May 3, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
6.0
In the wild
Unconfirmed
What it is

Unquoted path or search item vulnerability in SugarSync versions prior to 4.1.3 for Windows. This misconfiguration could allow an unauthorized local user to inject arbitrary code into the unquoted service path, resulting in privilege escalation.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00170 · 6.0th percentile
Weakness
CWE-428 · Unquoted Search Path or Element
Published
2024-05-03T10:52Z
EPSS history
Timeline
  • 03 MAY 10:52Z
    Unquoted path or search item vulnerability in SugarSync
    cvelistv5