CVE-2023-49147
- State
- Published
- Severity
- Not scored
- Published
- Dec 19, 2023
- Updated
- Aug 2, 2024
- Reserved
- Nov 22, 2023
Description
An issue was discovered in PDF24 Creator 11.14.0. The configuration of the msi installer file was found to produce a visible cmd.exe window when using the repair function of msiexec.exe. This allows an unprivileged local attacker to use a chain of actions (e.g., an oplock on faxPrnInst.log) to open a SYSTEM cmd.exe.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 20231212 SEC Consult SA-20231211-0 :: Local Privilege Escalation via MSI installer in PDF24 Creatormailing-list
- http://packetstormsecurity.com/files/176206/PDF24-Creator-11.15.1-Local-Privilege-Escalation.html
- https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-via-msi-installer-in-pdf24-creator-geek-software-gmbh/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.