CVE-2022-23742 — Windows Hard Link in Checkpoint Endpoint Security

CWE-65 — Windows Hard LinkCWE-59 — Link Following3 documents3 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 74.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Checkpoint Endpoint SecurityCheck Point Endpoint Security Client FOR Windows
Timeline
PublishedMay 12
Latest updateMay 13

Description

Check Point Endpoint Security Client for Windows versions earlier than E86.40 copy files for forensics reports from a directory with low privileges. An attacker can replace those files with malicious or linked content, such as exploiting CVE-2020-0896 on unpatched systems or using symbolic links.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-427v-j2g7-ww5m: Check Point Endpoint Security Client for Windows versions earlier than E86↗2022-05-13
▶
CVEList
CVE-2022-23742: Check Point Endpoint Security Client for Windows versions earlier than E86↗2022-05-12
▶
CVE-2022-23742 — Windows Hard Link in Checkpoint | cvebase