VULNERABILITY INTELLIGENCE
CVE-2015-7359
CVSS score7.8 HIGH
EPSS probability0.58%
CISA KEVNot currently listed
Published2017-10-03
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, do not check the impersonation level of impersonation tokens, which allows local users to impersonate a user at SecurityIdentify level and gain access to other users' mounted encrypted volumes.
Primary references
- cve@mitre.org — Third Party Advisory, VDB Entry
- cve@mitre.org — Mailing List, Third Party Advisory
- cve@mitre.org — Issue Tracking, Mailing List, Third Party Advisory
- cve@mitre.org — Issue Tracking, Third Party Advisory
- cve@mitre.org — Release Notes, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Mailing List, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory