NVD Vulnerability Detail

CVE-2020-15261

Summary	On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malicious executables with LocalSystem privileges. Since Veyon users (both students and teachers) usually don't have administrative privileges, this vulnerability is only dangerous in anyway unsafe setups. The problem has been fixed in version 4.4.2. As a workaround, the exploitation of the vulnerability can be prevented by revoking administrative privileges from all potentially untrustworthy users.
Publication Date	Oct. 20, 2020, 7:15 a.m.
Registration Date	Jan. 26, 2021, 11:53 a.m.
Last Update	Nov. 21, 2024, 2:05 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://packetstormsecurity.com/files/162873/Veyon-4.4.1-Unquoted-Service-Path.html	Exploit Third Party Advisory VDB Entry
2	http://packetstormsecurity.com/files/162873/Veyon-4.4.1-Unquoted-Service-Path.html	Exploit Third Party Advisory VDB Entry
3	https://github.com/veyon/veyon/commit/f231ec511b9a09f43f49b2c7bb7c60b8046276b1	Patch Third Party Advisory
4	https://github.com/veyon/veyon/commit/f231ec511b9a09f43f49b2c7bb7c60b8046276b1	Patch Third Party Advisory
5	https://github.com/veyon/veyon/issues/657	Issue Tracking Third Party Advisory
6	https://github.com/veyon/veyon/issues/657	Issue Tracking Third Party Advisory
7	https://github.com/veyon/veyon/security/advisories/GHSA-c8cc-x786-hqqp	Third Party Advisory
8	https://github.com/veyon/veyon/security/advisories/GHSA-c8cc-x786-hqqp	Third Party Advisory
9	https://www.exploit-db.com/exploits/48246	Exploit Third Party Advisory VDB Entry
10	https://www.exploit-db.com/exploits/48246	Exploit Third Party Advisory VDB Entry
11	https://www.exploit-db.com/exploits/49925	Exploit Third Party Advisory VDB Entry
12	https://www.exploit-db.com/exploits/49925	Exploit Third Party Advisory VDB Entry

Common Vulnerabilities List

JVN Vulnerability Information

Windows 用 Veyon サービスにおける引用されない検索パスまたは要素に関する脆弱性

Title	Windows 用 Veyon サービスにおける引用されない検索パスまたは要素に関する脆弱性
Summary	Windows 用 Veyon サービスには、引用されない検索パスまたは要素に関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Sept. 1, 2020, midnight
Registration Date	May 18, 2021, 1:55 p.m.
Last Update	May 18, 2021, 1:55 p.m.

Affected System

veyon

veyon 4.4.2 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-15261	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15261
National Vulnerability Database (NVD)
2	CVE-2020-15261	https://nvd.nist.gov/vuln/detail/CVE-2020-15261

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-428	https://cwe.mitre.org/data/definitions/428.html

ベンダー情報

No	Name	URL
GitHub
1	Unquoted service path #657	https://github.com/veyon/veyon/issues/657
2	Unquoted service path vulnerability on Microsoft Windows	https://github.com/veyon/veyon/security/advisories/GHSA-c8cc-x786-hqqp
3	WindowsServiceControl: quote service binary path	https://github.com/veyon/veyon/commit/f231ec511b9a09f43f49b2c7bb7c60b8046276b1

Change Log

No	Changed Details	Date of change
1	[2021年05月18日] 掲載	May 18, 2021, 1:55 p.m.