PT-2023-11469 · Beyondtrust · Beyondtrust Privilege Management For Windows

Published 2023-12-11 · Updated 2023-12-14 · CVE-2020-12613

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BeyondTrust Privilege Management for Windows versions through 5.6

Description An issue was discovered where an attacker can spawn a process with multiple users as part of the security token. When Avecto elevates the process, it removes the user who is launching the process, but not the second user, allowing the second user to retain access and potentially give permission to the process back to the first user.

Recommendations For versions through 5.6, consider disabling the Avecto elevation feature until a patch is available to prevent the exploitation of this issue. Restrict access to the security token to minimize the risk of unauthorized process spawning. Avoid using multiple users as part of the security token in the affected process until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2020-12613

Affected Products

Beyondtrust Privilege Management For Windows

References · 6

• https://beyondtrust.com/trust-center/security-advisories/bt22-11 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12613 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12613 · Vendor Advisory
• https://t.me/cvenotify/63243 · Telegram Post
• https://twitter.com/CVEnew/status/1734336086241866040 · Twitter Post
• https://beyondtrust.com/support/changelog/privilege-management-for-windows-5-6-sr1 · Note