CVE-2020-23967

Dr.Web Security Space versions 11 and 12 allow elevation of privilege for local users without administrative privileges to NT AUTHORITY\SYSTEM due to insufficient control during autoupdate.

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

0.32% chance of exploitation in the next 30 days, 25th percentile

Published

2021-03-08

Updated

2024-08-04

Proof-of-concept exploits (2)

• https://habr.com/ru/company/pm/blog/509592/
• https://www.youtube.com/watch?v=q7Kqi7kE59U

References

• CVE Record
• NVD entry

Related

• CVE-2020-23966
• CVE-2020-23968
• CVE-2020-23957
• CVE-2020-23971
• CVE-2020-23945
• CVE-2020-23972