PT-2021-2779 · Cscape · Cscape

Published 2021-04-23 · Updated 2022-10-25 · CVE-2021-22682

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cscape versions prior to 9.90 SP4

Description The issue is related to inadequate access control in the Cscape software. Exploitation of this issue may allow an attacker to elevate their privileges. The software is configured by default to be installed for all users, granting full permissions, including read/write access. This configuration may enable unprivileged users to modify binaries and configuration files, potentially leading to local privilege escalation.

Recommendations For versions prior to 9.90 SP4, update to version 9.90 SP4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Cscape installation directory to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2021-02322

CVE-2021-22682

Affected Products

Cscape

References · 6

• https://osv.dev/vulnerability/CVE-2021-22682 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22682 · Security Note
• https://bdu.fstec.ru/vul/2021-02322 · Security Note
• https://cybersecurity-help.cz/vdb/SB2021042322 · Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-112-01 · Note
• https://us-cert.gov/ics/advisories/icsa-21-112-01 · Note