CVE-2018-7484 - CVE House
Back to Database
Status published High CVE-2018-7484

An issue was discovered in PureVPN through 5.19.4.0 on Windows....

Vulnerability Description

An issue was discovered in PureVPN through 5.19.4.0 on Windows. The client installation grants the Everyone group Full Control permission to the installation directory. In addition, the PureVPNService.exe service, which runs under NT Authority\SYSTEM privileges, tries to load several dynamic-link libraries using relative paths instead of the absolute path. When not using a fully qualified path, the application will first try to load the library from the directory from which the application is started. As the residing directory of PureVPNService.exe is writable to all users, this makes the application susceptible to privilege escalation through DLL hijacking.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-7484

Credits & Attribution

No credits recorded in the NVD database.

References

More from purevpn

View All →
CVE-2018-6822
In PureVPN 6.0.1 on macOS, HelperTool LaunchDaemon implements an unprotected...
Critical 9.8
CVE-2018-18656
The PureVPN client before 6.1.0 for Windows stores Login Credentials...
High 7.8
CVE-2018-10204
PureVPN 6.0.1 for Windows suffers from a SYSTEM privilege escalation...
High 8.8

Affected Vendor

Affected Software

purevpn
Vulnerable Versions:
5.19.4.0

Timeline

Official Publish: February 26th, 2018
Last Modified: September 16th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.