CVEvulnerability

CVE-2019-8454

7.0 HIGH Published 2019-04-29 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-04-29
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.0 HIGH — CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.9 MEDIUM — AV:L/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-59, CWE-65

Description

A local attacker can create a hard-link between a file to which the Check Point Endpoint Security client for Windows before E80.96 writes and another BAT file, then by impersonating the WPAD server, the attacker can write BAT commands into that file that will later be run by the user or the system.

Affected configurations

• checkpoint endpoint security (< e80.96)

Related

Weakness · CWE (2)

  • CWE-59 Improper Link Resolution Before File Access weakness
  • CWE-65 Windows Hard Link weakness

References