CVE-2018-17493 Privilege escalation in eVisitorPass
A local attacker can exploit a flaw in the eVisitorPass kiosk mode to close the application and execute arbitrary processes, gaining elevated privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-17493?
CVE-2018-17493 is a high-severity vulnerability in eVisitorPass, published on 19 Mar 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error with the Fullscreen button. By visiting the kiosk and clicking the full screen button in the bottom right, an attacker could exploit this vulnerability to close the program and launch other processes on the system.
Which versions are affected by CVE-2018-17493?
It affects 1 product.
Products include Thresholdsecurity Evisitorpass.
How do I fix CVE-2018-17493?
No fix has been published for CVE-2018-17493 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-17493 being exploited?
There is no known exploitation of CVE-2018-17493 in the wild and no public exploit code.
Other vulnerabilities in eVisitorPass
Sources
Also known as GHSA-c8g2-9jcj-w2q6.