CVE-2023-37907

low-risk
Published 2023-07-25

Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation (LPE) for low privileged users, if already installed. The problem occurs as the repair function of the MSI spawns two administrative CMDs. A simple LPE is possible via a breakout. Version 1.9.2 fixes this issue.

Do I need to act?

-
0.04% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.0/10 High
LOCAL / HIGH complexity

Affected Products (1)

Cryptomator

Affected Vendors

Cryptomator

References (6)

Patch https://github.com/cryptomator/cryptomator/commit/b48ebd524b1626bf12ac98e35a7670...
Release Notes https://github.com/cryptomator/cryptomator/releases/tag/1.9.2
Exploit https://github.com/cryptomator/cryptomator/security/advisories/GHSA-9c9p-c3mg-hp...
Patch https://github.com/cryptomator/cryptomator/commit/b48ebd524b1626bf12ac98e35a7670...
Release Notes https://github.com/cryptomator/cryptomator/releases/tag/1.9.2
Exploit https://github.com/cryptomator/cryptomator/security/advisories/GHSA-9c9p-c3mg-hp...
23
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal