PT-2020-20811 · Apple · Windows Migration Assistant

Csaba Fitzl + 1 · Published 2020-06-09 · Updated 2020-06-15 · CVE-2020-9858

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows Migration Assistant versions prior to 2.2.0.0 (v. 1A11)

Description A dynamic library loading issue was addressed with improved path searching. Running the installer in an untrusted directory may result in arbitrary code execution.

Recommendations For versions prior to 2.2.0.0 (v. 1A11), update to Windows Migration Assistant 2.2.0.0 (v. 1A11) to resolve the issue. As a temporary workaround, consider avoiding running the installer in untrusted directories until the update is applied.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2020-9858

Affected Products

Windows Migration Assistant

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-9858 · Security Note
• https://support.apple.com/HT211186 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-9858 · Vendor Advisory