CVE-2022-25372 : Pritunl Client through 1.2.3019.52 on Windows allows local privilege escalation,

Pritunl Client through 1.2.3019.52 on Windows allows local privilege escalation, related to an ACL entry for CREATOR OWNER in platform_windows.go.

Published 2022-02-20 20:15:18

Updated 2022-04-27 17:04:08

Source MITRE

View at NVD, CVE.org

Vulnerability category: Gain privilege

Products affected by CVE-2022-25372

Pritunl » Pritunl-client-electron
Versions before (<) 1.2.3019.52a
cpe:2.3:a:pritunl:pritunl-client-electron:*:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows » Version: N/A

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Assigned by: nvd@nist.gov (Primary)

https://github.com/pritunl/pritunl-client-electron/blob/caa78d626198b6961f3f39eca2acd39064c2df96/CHANGES#L6

pritunl-client-electron/CHANGES at caa78d626198b6961f3f39eca2acd39064c2df96 · pritunl/pritunl-client-electron · GitHub
Release Notes;Third Party Advisory
https://rhinosecuritylabs.com/penetration-testing/cve-2022-25372-local-privilege-escalation-in-pritunl-vpn-client/

CVE-2022-25372:Local Privilege Escalation in Pritunl VPN Client - Rhino Security Labs
Exploit;Technical Description;Third Party Advisory
https://github.com/pritunl/pritunl-client-electron/commit/e16d47437f8ef62546aa00edb0d64be2a7d2205b

Update acl in service platform windows · pritunl/pritunl-client-electron@e16d474 · GitHub
Patch;Third Party Advisory

Jump to