Skip to main content

Connect CVE-2020-9442

HIGH
Improper Preservation of Permissions (CWE-281)
2020-02-28 cve@mitre.org
Microsoft Information Disclosure Connect
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Feb 28, 2020 - 14:15 nvd
HIGH 7.8

DescriptionNVD

OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10, which allows local users to gain privileges by copying a malicious drvstore.dll there.

AnalysisAI

OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10, which allows local users to gain privileges by copying a malicious. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-281. OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10, which allows local users to gain privileges by copying a malicious drvstore.dll there. Affected products include: Openvpn Connect.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Connect

View all
CVE-2021-26715 CRITICAL POC
9.1 Mar 25

The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF)
CVE-2021-27582 CRITICAL POC
9.1 Feb 23

org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect th
CVE-2016-7851 MEDIUM POC
6.1 Nov 08

Adobe Connect version 9.5.6 and earlier does not adequately validate input in the events registration module. Rated medi
CVE-2017-11291 CRITICAL
10.0 Dec 09

An issue was discovered in Adobe Connect 9.6.2 and earlier versions. Rated critical severity (CVSS 10.0), this vulnerabi
CVE-2016-0949 CRITICAL
9.8 Feb 10

Adobe Connect before 9.5.2 allows remote attackers to have an unspecified impact via a crafted parameter in a URL. Rated
CVE-2022-38131 MEDIUM POC
6.1 Sep 06

RStudio Connect prior to 2023.01.0 is affected by an Open Redirect issue. Rated medium severity (CVSS 6.1), this vulnera
CVE-2020-5497 MEDIUM POC
6.1 Jan 04

The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being inclu
CVE-2023-4662 CRITICAL
9.8 Sep 15

Execution with Unnecessary Privileges vulnerability in Saphira Saphira Connect allows Remote Code Inclusion. Rated criti
CVE-2023-4661 CRITICAL
9.8 Sep 15

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saphira Saphira Co
CVE-2021-40719 CRITICAL
9.8 Oct 21

Adobe Connect version 11.2.3 (and earlier) is affected by a Deserialization of Untrusted Data vulnerability to achieve a
CVE-2020-4747 CRITICAL
9.8 Dec 15

IBM Connect:Direct for UNIX 6.1.0, 6.0.0, 4.3.0, and 4.2.0 can allow a local or remote user to obtain an authenticated C
CVE-2018-12805 CRITICAL
9.8 Jul 20

Adobe Connect versions 9.7.5 and earlier have an Insecure Library Loading vulnerability. Rated critical severity (CVSS 9

Same weakness CWE-281 – Improper Preservation of Permissions

View all
CVE-2017-8543 CRITICAL
9.8
CVE-2024-46310 CRITICAL POC
9.1
CVE-2017-8589 CRITICAL
9.8
CVE-2024-54879 CRITICAL POC
9.1
CVE-2024-41650 CRITICAL POC
9.8
CVE-2024-41649 CRITICAL POC
9.8
CVE-2024-41648 CRITICAL POC
9.8
CVE-2024-41646 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2020-9442 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy