Security Bulletins
1E-2020-2003
Improper link resolution in 1E client
1. Vulnerability Details
CVE-ID | |
Description | The %PROGRAMDATA%\1E\Client directory in 1E Client 5.0.0.745 and 4.1.0.267 allows remote authenticated users and local users to create and modify files in protected directories (where they would not normally have access to create or modify files) via the creation of a junction point to a system directory. This leads to partial privilege escalation. This vulnerability can be mitigated by changing the permission of the ProgramData\1E\Client directory so that a standard user does not have the ability to create and modify files. |
CVSS3.1 Score | Base Score 6.5 (Medium) |
CVSS3.1 Vector String | |
Problem type |
2. Affected products and versions
| Product | Versions |
|---|---|
1E Client for Windows | 5.0.x |
1E Client for Windows | 4.1.x |