PT-2021-10146 · Techsmith+1 · Techsmith Snagit+2

Published 2021-07-26 · Updated 2024-08-04 · CVE-2020-18169

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: TechSmith Snagit version 19.1.1.2860

Description: A vulnerability in the Windows installer XML (WiX) toolset of TechSmith Snagit allows attackers to escalate privileges. The exploitation of the Snagit installer would require the end user to ignore other safety mechanisms provided by the Host OS.

Recommendations: For TechSmith Snagit version 19.1.1.2860, consider updating to a newer version that addresses the issue, as the current version allows privilege escalation through the Windows installer XML (WiX) toolset. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2020-18169

Affected Products

Techsmith Snagit

Wix

Windows

References · 8

• 🔥 https://github.com/GitHubAssessments/CVE_Assessment_04_2019/blob/master/Snagit_Report.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-18169 · Security Note
• https://osv.dev/vulnerability/CVE-2020-18169 · Vendor Advisory
• https://t.me/cvenotify/18172 · Telegram Post
• https://t.me/cibsecurity/26525 · Telegram Post
• https://t.me/cvenotify/18697 · Telegram Post
• https://t.me/cvenotify/88997 · Telegram Post
• https://docs.google.com/document/d/1W33rsdISmexLOGS4VmLUIITRU_KqGULcij1Z6QyxsjU/edit?usp=sharing · Note