Vulnerability · Published Jul 25, 2023 · Assigned by GitHub_M

CVE-2023-37907Cryptomator's MSI installer allows local privilege escalation

High 7.0

In plain English

A high-severity privilege mismanagement in cryptomator from cryptomator. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High

Exploit odds (30 days)0.2%top 90.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation (LPE) for low privileged users, if already installed. The problem occurs as the repair function of the MSI spawns two administrative CMDs. A simple LPE is possible via a breakout. Version 1.9.2 fixes this issue.

Affected products (as reported)

Vendor	Product	Versions
cryptomator	cryptomator	1.9.2

Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/cryptomator/cryptomator/security/advisories/GHSA-9c9p-c3mg-hpjq x_refsource_CONFIRM
https://github.com/cryptomator/cryptomator/commit/b48ebd524b1626bf12ac98e35a7670b868fa208c x_refsource_MISC
https://github.com/cryptomator/cryptomator/releases/tag/1.9.2 x_refsource_MISC