CVE-2020-6021 — Uncontrolled Search Path Element in Checkpoint Endpoint Security

CWE-427 — Uncontrolled Search Path Element3 documents3 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 82.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Checkpoint Endpoint SecurityCheck Point Endpoint Security Client FOR Windows
Timeline
PublishedDec 3
Latest updateMay 24

Description

Check Point Endpoint Security Client for Windows before version E84.20 allows write access to the directory from which the installation repair takes place. Since the MS Installer allows regular users to run the repair, an attacker can initiate the installation repair and place a specially crafted DLL in the repair folder which will run with the Endpoint client’s privileges.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-p633-7rgq-3w9f: Check Point Endpoint Security Client for Windows before version E84↗2022-05-24
▶
CVEList
CVE-2020-6021: Check Point Endpoint Security Client for Windows before version E84↗2020-12-03
▶
CVE-2020-6021 — Uncontrolled Search Path Element | cvebase