CVE-2022-23909

There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This might allow a local user to escalate privileges by creating a "C:\Program Files\Sherpa Software\Sherpa.exe" file.

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

1.03% chance of exploitation in the next 30 days, 61th percentile

Published

2022-04-05

Updated

2024-08-03

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/166574/Sherpa-Connector-Service-2020.2.20328.2050-Un…
• netsectuna/CVE-2022-239093★ · 2022-04-06

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50852

References

• CVE Record
• NVD entry

Related

• CVE-2022-23907
• CVE-2022-2391
• CVE-2022-23900
• CVE-2022-23911
• CVE-2022-23899
• CVE-2022-23912