CVE-2020-11005

low-risk

Published 2020-04-14

The WindowsHello open source library (NuGet HaemmerElectronics.SeppPenner.WindowsHello), before version 1.0.4, has a vulnerability where encrypted data could potentially be decrypted without needing authentication. If the library is used to encrypt text and write the output to a txt file, another executable could be able to decrypt the text using the static method NCryptDecrypt from this same library without the need to use Windows Hello Authentication again. This has been patched in version 1.0.4.

Do I need to act?

0.02% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.1/10 Medium

LOCAL / HIGH complexity

Affected Products (1)

Windowshello

Affected Vendors

Windowshello Project

References (4)

Issue Tracking https://github.com/SeppPenner/WindowsHello/issues/3

Third Party Advisory https://github.com/SeppPenner/WindowsHello/security/advisories/GHSA-wvpv-ffcv-r6...

Issue Tracking https://github.com/SeppPenner/WindowsHello/issues/3

Third Party Advisory https://github.com/SeppPenner/WindowsHello/security/advisories/GHSA-wvpv-ffcv-r6...

/ 100

low-risk

Severity 13/34 · Low

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal