GHSA-w62m-j7rv-p5ffHighCVSS 7.8
Syncplify.me Server! 5.0.37 contains an unquoted service path vulnerability in the...
🔗 CVE IDs covered (1)
📋 Description
Syncplify.me Server! 5.0.37 contains an unquoted service path vulnerability in the SMWebRestServicev5 service that allows local attackers to escalate privileges by exploiting the unquoted binary path. Attackers can insert a malicious executable into the service path and execute it with LocalSystem privileges when the service restarts or the system reboots.
🔗 References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2020-37230
- https://download.syncplify.me/SMServer_Setup.exe
- https://www.exploit-db.com/exploits/49009
- https://www.syncplify.me
- https://www.vulncheck.com/advisories/syncplify-me-server-unquoted-service-path-privilege-escalation
- https://github.com/advisories/GHSA-w62m-j7rv-p5ff