CVE search · CVE-2020-12613
CVE-2020-12613
high 8.8
An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. An attacker can spawn a process with multiple users as part of the security token (prior to Avecto elevation). When Avecto elevates the process, it removes the user who is launching the process, but not the second user. Therefore this second user still retains access and can give permission to the process back to the first user.
Details
- Status
- Modified
- Published
- Last changed
- Source
- cve@mitre.org
- Weakness
- NVD-CWE-noinfo
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | high 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- beyondtrust · privilege_management_for_windows
References
- https://www.beyondtrust.com/support/changelog/privilege-management-for-windows-5-6-sr1Release Notes
- https://www.beyondtrust.com/trust-center/security-advisories/bt22-11Vendor Advisory
- https://www.beyondtrust.com/support/changelog/privilege-management-for-windows-5-6-sr1Release Notes
- https://www.beyondtrust.com/trust-center/security-advisories/bt22-11Vendor Advisory