CVEvulnerability

CVE-2018-4007

7.1 HIGH Published 2019-04-17 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-04-17
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.1 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS 3.0 ([email protected])
9.0 CRITICAL — CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
CVSS 2.0 ([email protected])
6.6 MEDIUM — AV:L/AC:L/Au:N/C:N/I:C/A:C
Weaknesses
CWE-20

Description

An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the deleteConfig functionality. The program is able to delete any protected file on the system. An attacker would need local access to the machine to successfully exploit the bug.

Affected configurations

• shimovpn shimo vpn 4.1.5.1

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References