PT-2019-4145 · Check Point · Check Point Endpoint Security Initial Client
Published
2019-08-26
·
Updated
2019-10-09
·
CVE-2019-8461
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Check Point Endpoint Security Initial Client for Windows versions prior to E81.30
Description
The issue is related to an unbounded file upload vulnerability. It may allow a remote attacker to elevate their privileges. An attacker can leverage this to gain local privilege escalation (LPE) using a specially crafted DLL placed in any PATH location accessible with write permissions to the user.
Recommendations
For versions prior to E81.30, update to version E81.30 or later to resolve the issue. As a temporary workaround, consider restricting write access to PATH locations to minimize the risk of exploitation.
Exploit
Fix
Untrusted Search Path
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Check Point Endpoint Security Initial Client