CVE-2020-12614

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-12614
An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. If the publisher criteria is selected, it defines the name of a publisher that must be present in the certificate (and also requires that the certificate is valid). If an Add Admin token is protected by this criteria, it can be leveraged by a malicious actor to achieve Elevation of Privileges from standard user to administrator.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.beyondtrust.com/support/changelog/privilege-management-for-windows-5-6-sr1 Release Notes
https://www.beyondtrust.com/trust-center/security-advisories/bt22-10 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:beyondtrust:privilege_management_for_windows:*:*:*:*:*:*:*:*
History

14 Dec 2023, 20:24

Type Values Removed Values Added
CWE NVD-CWE-noinfo
Summary
  • (es) Se descubrió un problema en BeyondTrust Privilege Management para Windows hasta 5.6. Si se seleccionan los criterios del editor, se define el nombre de un editor que debe estar presente en el certificado (y también requiere que el certificado sea válido). Si un token Agregar administrador está protegido por este criterio, un actor malintencionado puede aprovecharlo para lograr la elevación de privilegios de usuario estándar a administrador.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CPE cpe:2.3:a:beyondtrust:privilege_management_for_windows:*:*:*:*:*:*:*:*
First Time Beyondtrust
Beyondtrust privilege Management For Windows
References () https://www.beyondtrust.com/support/changelog/privilege-management-for-windows-5-6-sr1 - () https://www.beyondtrust.com/support/changelog/privilege-management-for-windows-5-6-sr1 - Release Notes
References () https://www.beyondtrust.com/trust-center/security-advisories/bt22-10 - () https://www.beyondtrust.com/trust-center/security-advisories/bt22-10 - Vendor Advisory

12 Dec 2023, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-12 15:15

Updated : 2023-12-14 20:24

NVD link : CVE-2020-12614

Mitre link : CVE-2020-12614

CVE.ORG link : CVE-2020-12614

JSON object : View

Products Affected

beyondtrust

  • privilege_management_for_windows
CWE
NVD-CWE-noinfo