{"containers": {"cna": {"affected": [{"platforms": ["Windows"], "product": "Secdo", "vendor": "Secdo", "versions": [{"status": "affected", "version": "all versions"}]}], "credits": [{"lang": "en", "value": "We like to thank Eviatar Gerzi of CyberArk Labs Team for discovering and reporting this issue."}], "datePublic": "2020-04-08T00:00:00", "descriptions": [{"lang": "en", "value": "Improper input validation vulnerability in Secdo allows an authenticated local user with 'create folders or append data' access to the root of the OS disk (C:\\) to cause a system crash on every login. This issue affects all versions Secdo for Windows."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-04-08T18:41:58", "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://security.paloaltonetworks.com/CVE-2020-1986"}], "solutions": [{"lang": "en", "value": "This product is no longer supported and the issue will not be fixed. This issue can be easily mitigated by creating a \"C:\\proc\" folder and not allowing unprivileged users to access to that folder, or ensuring unprivileged users do not have 'create folder' access to the root of a disk (C:\\)."}], "source": {"defect": ["PDV-1615"], "discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2020-04-08T00:00:00", "value": "Initial publication"}], "title": "Secdo: Local authenticated users can cause Windows system crash", "workarounds": [{"lang": "en", "value": "Exploitation of this issue can be prevented by creating a \"C:\\proc\" folder and not allowing unprivileged users to access that folder."}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@paloaltonetworks.com", "DATE_PUBLIC": "2020-04-08T16:00:00.000Z", "ID": "CVE-2020-1986", "STATE": "PUBLIC", "TITLE": "Secdo: Local authenticated users can cause Windows system crash"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Secdo", "version": {"version_data": [{"platform": "Windows", "version_affected": "=", "version_value": "all versions"}]}}]}, "vendor_name": "Secdo"}]}}, "credit": [{"lang": "eng", "value": "We like to thank Eviatar Gerzi of CyberArk Labs Team for discovering and reporting this issue."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Improper input validation vulnerability in Secdo allows an authenticated local user with 'create folders or append data' access to the root of the OS disk (C:\\) to cause a system crash on every login. This issue affects all versions Secdo for Windows."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-20 Improper Input Validation"}]}]}, "references": {"reference_data": [{"name": "https://security.paloaltonetworks.com/CVE-2020-1986", "refsource": "MISC", "url": "https://security.paloaltonetworks.com/CVE-2020-1986"}]}, "solution": [{"lang": "en", "value": "This product is no longer supported and the issue will not be fixed. This issue can be easily mitigated by creating a \"C:\\proc\" folder and not allowing unprivileged users to access to that folder, or ensuring unprivileged users do not have 'create folder' access to the root of a disk (C:\\)."}], "source": {"defect": ["PDV-1615"], "discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2020-04-08T00:00:00", "value": "Initial publication"}], "work_around": [{"lang": "en", "value": "Exploitation of this issue can be prevented by creating a \"C:\\proc\" folder and not allowing unprivileged users to access that folder."}]}}}, "cveMetadata": {"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "assignerShortName": "palo_alto", "cveId": "CVE-2020-1986", "datePublished": "2020-04-08T00:00:00", "dateReserved": "2019-12-04T00:00:00", "dateUpdated": "2020-04-08T18:41:58", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:paloaltonetworks:secdo:*:*:*:*:*:*:*:*", "matchCriteriaId": "B835C853-95EF-4218-910C-37FA516FA9EF", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Improper input validation vulnerability in Secdo allows an authenticated local user with 'create folders or append data' access to the root of the OS disk (C:\\) to cause a system crash on every login. This issue affects all versions Secdo for Windows."}, {"lang": "es", "value": "Una vulnerabilidad de comprobaci\u00f3n de entrada incorrecta en Secdo, permite que un usuario local autenticado con acceso para \"create folders or append data\" en la root del disco del Sistema Operativo (C:\\) para causar un bloqueo del sistema en cada inicio de sesi\u00f3n. Este problema afecta a todas las versiones de Secdo para Windows."}], "id": "CVE-2020-1986", "lastModified": "2020-04-10T14:28:48.423", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 4.9, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "psirt@paloaltonetworks.com", "type": "Secondary"}]}, "published": "2020-04-08T19:15:13.777", "references": [{"source": "psirt@paloaltonetworks.com", "tags": ["Vendor Advisory"], "url": "https://security.paloaltonetworks.com/CVE-2020-1986"}], "sourceIdentifier": "psirt@paloaltonetworks.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "psirt@paloaltonetworks.com", "type": "Secondary"}]}

{}