← Zuruck zu CVEs

CVE-2023-39520

MEDIUM

5.5

Beschreibung

Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 allows local privilege escalation for low privileged users, via the `repair` function. The problem occurs as the repair function of the MSI is spawning an SYSTEM Powershell without the `-NoProfile` parameter. Therefore the profile of the user starting the repair will be loaded. Version 1.9.3 contains a fix for this issue. Adding a `-NoProfile` to the powershell is a possible workaround.

CVE Details

CVSS v3.1 Bewertung5.5

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AngriffsvektorLOCAL

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht8/7/2023

Zuletzt geandert4/10/2025

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

cryptomator:cryptomator

Schwachen (CWE)

CWE-269

Referenzen

https://github.com/cryptomator/cryptomator/commit/727c32ad50c3901a6144a11cf984a3b7ebcf8b2b(security-advisories@github.com)

https://github.com/cryptomator/cryptomator/releases/download/1.9.2/Cryptomator-1.9.2-x64.msi(security-advisories@github.com)

https://github.com/cryptomator/cryptomator/releases/tag/1.9.3(security-advisories@github.com)

https://github.com/cryptomator/cryptomator/security/advisories/GHSA-62gx-54j7-mjh3(security-advisories@github.com)

https://github.com/cryptomator/cryptomator/commit/727c32ad50c3901a6144a11cf984a3b7ebcf8b2b(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/cryptomator/cryptomator/releases/download/1.9.2/Cryptomator-1.9.2-x64.msi(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/cryptomator/cryptomator/releases/tag/1.9.3(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/cryptomator/cryptomator/security/advisories/GHSA-62gx-54j7-mjh3(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.