Attacker Value
High
(1 user assessed)
Exploitability
High
(1 user assessed)
User Interaction
None
Privileges Required
Low
Attack Vector
Local
0

CVE-2020-1985

Disclosure Date: April 08, 2020
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Incorrect Default Permissions on C:\Programdata\Secdo\Logs folder in Secdo allows local authenticated users to overwrite system files and gain escalated privileges. This issue affects all versions Secdo for Windows.

Add Assessment

1
Ratings
Technical Analysis

CVE-2020-1985 Secdo: Incorrect Default Permissions

Attack Vector LOCAL
Attack Complexity LOW
Privileges Required LOW
User Interaction NONE
Scope UNCHANGED
Confidentiality Impact HIGH
Integrity Impact HIGH
Availability Impact HIGH

Description

Incorrect Default Permissions on C:\Programdata\Secdo\Logs folder in Secdo allows local authenticated users to overwrite system files and gain escalated privileges. This issue affects all versions Secdo for Windows.

Product Status
Secdo
Versions Affected
all versions on Windows
Severity: HIGH
CVSSv3.1 Base Score: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Solution

This product is no longer supported and the issue will not be fixed. Change permission on C:\Programdata\Secdo\Logs folder to not allow unprivileged users access.

Workarounds and Mitigations

Change permission on C:\Programdata\Secdo\Logs to not allow unprivileged users access.

Acknowledgements

We like to thank Eviatar Gerzi of CyberArk Labs Team for discovering and reporting this issue.

https://security.paloaltonetworks.com/CVE-2020-1985

CVSS V3 Severity and Metrics
Base Score:
7.8 High
Impact Score:
5.9
Exploitability Score:
1.8
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • paloaltonetworks

Products

  • secdo

Additional Info

Technical Analysis