CVEvulnerability

CVE-2021-27241

6.1 MEDIUM Published 2021-03-29 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-03-29
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CVSS 3.0 ([email protected])
6.1 MEDIUM — CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CVSS 2.0 ([email protected])
3.6 LOW — AV:L/AC:L/Au:N/C:N/I:P/A:P
Weaknesses
CWE-59

Description

This vulnerability allows local attackers to delete arbitrary directories on affected installations of Avast Premium Security 20.8.2429 (Build 20.8.5653.561). An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the AvastSvc.exe module. By creating a directory junction, an attacker can abuse the service to delete a directory. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-12082.

Affected configurations

• avast premium security 20.8.2429

Related

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References