Secdo: Privilege escalation via hardcoded script path
Vulnerability Description
Secdo tries to execute a script at a hardcoded path if present, which allows a local authenticated user with 'create folders or append data' access to the root of the OS disk (C:\) to gain system privileges if the path does not already exist or is writable. This issue affects all versions of Secdo for Windows.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-1984
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- We like to thank Eviatar Gerzi of CyberArk Labs Team for discovering and reporting this issue.
Affected Vendor
Secdo
View all reports →