CVE-2020-26894

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "LiveCode v9.6.1 on Windows allows local, low-privileged users to gain privileges by creating a malicious \"cmd.exe\" in the folder of the vulnerable LiveCode application. If the application is using LiveCode's \"shell()\" function, it will attempt to search for \"cmd.exe\" in the folder of the current application and run the malicious \"cmd.exe\"."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-10-22T16:32:41.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://john-woodman.com/posts/LiveCode-Privilege-Escalation-Vulnerability/"}, {"tags": ["x_refsource_MISC"], "url": "https://quality.livecode.com/show_bug.cgi?id=22942"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/livecode/livecode/pull/7454"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2020-26894", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "LiveCode v9.6.1 on Windows allows local, low-privileged users to gain privileges by creating a malicious \"cmd.exe\" in the folder of the vulnerable LiveCode application. If the application is using LiveCode's \"shell()\" function, it will attempt to search for \"cmd.exe\" in the folder of the current application and run the malicious \"cmd.exe\"."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://john-woodman.com/posts/LiveCode-Privilege-Escalation-Vulnerability/", "refsource": "MISC", "url": "https://john-woodman.com/posts/LiveCode-Privilege-Escalation-Vulnerability/"}, {"name": "https://quality.livecode.com/show_bug.cgi?id=22942", "refsource": "MISC", "url": "https://quality.livecode.com/show_bug.cgi?id=22942"}, {"name": "https://github.com/livecode/livecode/pull/7454", "refsource": "MISC", "url": "https://github.com/livecode/livecode/pull/7454"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T16:03:22.843Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://john-woodman.com/posts/LiveCode-Privilege-Escalation-Vulnerability/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://quality.livecode.com/show_bug.cgi?id=22942"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/livecode/livecode/pull/7454"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2020-26894", "datePublished": "2020-10-08T20:04:01.000Z", "dateReserved": "2020-10-08T00:00:00.000Z", "dateUpdated": "2024-08-04T16:03:22.843Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:faulknermedia:wildlife_issues_in_the_new_millennium:18.0.160:*:*:*:*:*:*:*", "matchCriteriaId": "3B4BDB27-F960-44AF-AEF5-0A75F13C871A", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LiveCode v9.6.1 on Windows allows local, low-privileged users to gain privileges by creating a malicious \"cmd.exe\" in the folder of the vulnerable LiveCode application. If the application is using LiveCode's \"shell()\" function, it will attempt to search for \"cmd.exe\" in the folder of the current application and run the malicious \"cmd.exe\"."}, {"lang": "es", "value": "LiveCode v9.6.1 en Windows permite a los usuarios locales con pocos privilegios obtener privilegios creando un \"cmd.exe\" malicioso en la carpeta de la aplicaci\u00f3n LiveCode vulnerable. Si la aplicaci\u00f3n utiliza la funci\u00f3n \"shell()\" de LiveCode, intentar\u00e1 buscar \"cmd.exe\" en la carpeta de la aplicaci\u00f3n actual y ejecutar el \"cmd.exe\" malicioso"}], "id": "CVE-2020-26894", "lastModified": "2026-06-17T03:08:28.900", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-10-08T21:15:10.370", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://github.com/livecode/livecode/pull/7454"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://john-woodman.com/posts/LiveCode-Privilege-Escalation-Vulnerability/"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://quality.livecode.com/show_bug.cgi?id=22942"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/livecode/livecode/pull/7454"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://john-woodman.com/posts/LiveCode-Privilege-Escalation-Vulnerability/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://quality.livecode.com/show_bug.cgi?id=22942"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}