PT-2020-14611 · Qihoo 360 · 360 Total Security

Windows No Bugs · Published 2020-07-21 · Updated 2021-07-21 · CVE-2020-15724

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 360 Total Security versions 12.1.0.1005 and below

Description A local privilege escalation issue exists when the Gamefolde calls GameChrome.exe, allowing an attacker to exploit DLL hijacking and bypass hips, potentially executing arbitrary code on the local system.

Recommendations For versions 12.1.0.1005 and below, update to a version above 12.1.0.1005 to resolve the issue. As a temporary workaround, consider restricting access to the GameChrome.exe executable to minimize the risk of exploitation.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2020-15724

Affected Products

360 Total Security

References · 3

• https://security.360.cn/News/news/id/232 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15724 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15724 · Vendor Advisory