PT-2023-15939 · Caphyon · Caphyon Advanced Installer

Heechan Kim + 1 · Publicado 2023-09-30 · Atualizado 2024-05-17 · CVE-2022-4956

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Caphyon Advanced Installer version 19.7

Description A critical vulnerability has been found in the WinSxS DLL Handler component of Caphyon Advanced Installer. The manipulation leads to an uncontrolled search path. Attacking locally is a requirement. The exploit has been disclosed to the public.

Recommendations For Caphyon Advanced Installer version 19.7, upgrade to version 19.7.1 to address this issue. It is recommended to upgrade the affected component. As a temporary workaround, consider restricting access to the WinSxS DLL Handler until the update is applied.

Exploit

Correção

Uncontrolled Search Path Element

Enumeração de Fraquezas

CWE-427

Identificadores relacionados

CVE-2022-4956

Produtos afetados

Caphyon Advanced Installer

Referências · 10

• 🔥 https://heegong.github.io/posts/Advaned-Installer-Local-Privilege-Escalation-Vulnerability · Exploit
• https://twitter.com/CVEnew/status/1708168119020388798 · Publicação no Twitter
• https://advancedinstaller.com/release-19.7.1.html#bugfixes · Correção
• https://vuldb.com/?ctiid.240903 · Nota
• https://vuldb.com/?id.240903 · Nota
• https://t.me/cvenotify/58816 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-4956 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-4956 · Nota de Segurança
• https://t.me/cibsecurity/71361 · Publicação no Telegram
• https://twitter.com/DMFezzaReedCISA/status/1708183182900597143 · Publicação no Twitter