CVE-2020-10865 — Inclusion of Functionality from Untrusted Control Sphere in Antivirus

CWE-829 — Inclusion of Functionality from Untrusted Control Sphere3 documents3 sources

Severity

7.5HIGHNVD

EPSS

0.4%

top 40.58%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Avast Antivirus

Timeline

PublishedApr 1

Latest updateMay 24

Description

An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to make arbitrary changes to the Components section of the Stats.ini file via RPC from a Low Integrity process.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDavast/antivirus< 20.0

🔴Vulnerability Details

GHSA

GHSA-7mhv-7jm4-99wr: An issue was discovered in Avast Antivirus before 20↗2022-05-24

▶

CVEList

CVE-2020-10865: An issue was discovered in Avast Antivirus before 20↗2020-04-01

▶