CVE-2020-15722

In version 12.1.0.1004 and below of 360 Total Security,when TPI calls the browser process, there exists a local privilege escalation vulnerability. An attacker who could exploit DLL hijacking could execute arbitrary code on the Local system.

CVSS v3 7.8 HIGH
CVSS v2.0 6.9 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 3.4 / Impact : 10.0

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://security.360.cn/News/news/id/232	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:360totalsecurity:360_total_security:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-07-21 18:15

Updated : 2021-07-21 11:39

NVD link : CVE-2020-15722

Mitre link : CVE-2020-15722

CVE.ORG link : CVE-2020-15722

JSON object : View

Products Affected

360totalsecurity

360_total_security

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2020-15722", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2020-07-21T18:15:20.007", "references": [{"url": "https://security.360.cn/News/news/id/232", "tags": ["Vendor Advisory"], "source": "security@360.cn"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "In version 12.1.0.1004 and below of 360 Total Security,when TPI calls the browser process, there exists a local privilege escalation vulnerability. An attacker who could exploit DLL hijacking could execute arbitrary code on the Local system."}, {"lang": "es", "value": "En 360 ??Total Security versi\u00f3n 12.1.0.1004 y por debajo, cuando TPI llama al proceso del navegador, se presenta una vulnerabilidad de escalada de privilegios local. Un atacante que podr\u00eda explotar el secuestro de DLL podr\u00eda ejecutar c\u00f3digo arbitrario en el sistema local"}], "lastModified": "2021-07-21T11:39:23.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:360totalsecurity:360_total_security:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D275F40A-818B-4D1A-955A-7A9CBB49CDA0", "versionEndIncluding": "12.1.0.1004"}], "operator": "OR"}]}], "sourceIdentifier": "security@360.cn"}