CVE-2019-6145

Published: Sep 20, 2019

Modified: Aug 4, 2024

PUBLISHED

Description

Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables to the vulnerable directories. Forcepoint thanks Peleg Hadar of SafeBreach Labs for finding this vulnerability and for reporting it to us.

Vendor	Product	Versions
Forcepoint	Forcepoint VPN Client for Windows	affected `versions earlier than 6.6.1`

References

https://safebreach.com/Post/Forcepoint-VPN-Client-for-Windows-Unquoted-Search-Path-and-Potential-Abuses-CVE-2019-6145

x_refsource_MISC

https://help.forcepoint.com/security/CVE/CVE-2019-6145.html

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2019-6145

Description

Affected Products

References