CVE-2020-9331

CryptoPro CSP through 5.0.0.10004 on 32-bit platforms allows Local Privilege Escalation (by local users with the SeChangeNotifyPrivilege right) because user-mode input is mishandled during process creation. An attacker can write arbitrary data to an arbitrary location in the kernel's address space.

Score

CVSS 3.1 7.8 High

Status

Modified - cve@mitre.org

Published

2020-10-23

Last modified

2024-08-04

Affected products

• Csp (Cryptopro)

References

• https://www.youtube.com/watch?v=b5vPDmMtzwQ