VULNERABILITY INTELLIGENCE
CVE-2023-37907
CVSS score7 HIGH
EPSS probability0.20%
CISA KEVNot currently listed
Published2023-07-25
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation (LPE) for low privileged users, if already installed. The problem occurs as the repair function of the MSI spawns two administrative CMDs. A simple LPE is possible via a breakout. Version 1.9.2 fixes this issue.
Weakness classification
- security-advisories@github.com: CWE-269
Primary references
- security-advisories@github.com — Patch
- security-advisories@github.com — Release Notes
- security-advisories@github.com — Exploit, Issue Tracking, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch
- af854a3a-2127-422b-91ae-364da2661108 — Release Notes
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Vendor Advisory