PT-2023-11737 · Cybereason · Cybereason Edr

Publicado 2023-01-20 · Atualizado 2023-01-30 · CVE-2020-25502

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cybereason EDR versions 19.1.282 and above Cybereason EDR versions 19.2.182 and above Cybereason EDR versions 20.1.343 and above Cybereason EDR versions 20.2.X and above

Description The issue is related to a DLL hijacking vulnerability, which could allow a local attacker to execute code with elevated privileges.

Recommendations For Cybereason EDR version 19.1.282 and above, update to a version that includes a fix for the DLL hijacking vulnerability. For Cybereason EDR version 19.2.182 and above, update to a version that includes a fix for the DLL hijacking vulnerability. For Cybereason EDR version 20.1.343 and above, update to a version that includes a fix for the DLL hijacking vulnerability. For Cybereason EDR version 20.2.X and above, update to a version that includes a fix for the DLL hijacking vulnerability. As a temporary workaround, consider restricting access to the vulnerable DLLs until a patch is available.

Correção

Uncontrolled Search Path Element

Enumeração de Fraquezas

CWE-427

Identificadores relacionados

CVE-2020-25502

Produtos afetados

Cybereason Edr

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-25502 · Nota de Segurança
• https://t.me/cibsecurity/56800 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2020-25502 · Aviso do Fabricante
• https://t.me/cvenotify/42589 · Publicação no Telegram
• https://cybereason.com/cybereason-vulnerability-disclosure · Aviso do Fabricante
• http://cybereason.com · Aviso do Fabricante
• http://endpoint.com · Nota