Description

Inappropriate implementation in the ChromeOS Readiness Tool installer on Windows prior to 1.0.2.0 loosens DCOM access rights on two objects allowing an attacker to potentially bypass discretionary access controls.

Related CPE's

a

google

chrome_os_readiness_tool

Vulnerable

o

microsoft

windows_10

-

o

microsoft

windows_7

-

o

microsoft

windows_8.1

-

References

https://bit.ly/37CS6G9

Third Party Advisory

https://crbug.com/1240952

Permissions Required

https://bit.ly/37CS6G9

Third Party Advisory

https://crbug.com/1240952

Permissions Required

Weaknesses

[email protected]

Primary
CWE-287

CVSS impact metrics

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.8 · High

Information

Source identifier

[email protected]

Vulnerability status

Modified

Published

2021-09-08T19:15:10.243Z

4 years ago

Last modified

2024-11-21T05:04:16.610Z

1 year ago