CVE-2018-10959 Privilege escalation in n/a
Attackers can escalate privileges by modifying environment variables to trigger automatic elevation of their process launch in Avecto Defendpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-10959?
CVE-2018-10959 is a high-severity vulnerability in n/a, published on 17 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Avecto Defendpoint 4 prior to 4.4 SR6 and 5 prior to 5.1 SR1 has an Untrusted Search Path vulnerability, exploitable by modifying environment variables to trigger automatic elevation of an attacker's process launch.
Weakness: CWE-426
Which versions are affected by CVE-2018-10959?
It affects 1 product.
Products include Beyondtrust Avecto Defendpoint.
How do I fix CVE-2018-10959?
No fix has been published for CVE-2018-10959 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-10959 being exploited?
There is no known exploitation of CVE-2018-10959 in the wild and no public exploit code.
Sources
Also known as GHSA-24q8-6wpc-mx3g.