Vulnerability Description
The VPN service in AVAST SecureLine before 5.6.4982.470 allows local users to write to arbitrary files via an Object Manager symbolic link from the log directory (which has weak permissions).
CVSS Score
5.5
MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Avast | Secureline Vpn | < 5.6.4982.470 |
Related Weaknesses (CWE)
References
- http://zeifan.my/security/arbitrary%20file/eop/2020/07/21/avast-secureline-vpn-aExploitThird Party Advisory
- http://zeifan.my/security/arbitrary%20file/eop/2020/07/21/avast-secureline-vpn-aExploitThird Party Advisory
FAQ
What is CVE-2020-25289?
CVE-2020-25289 is a vulnerability with a CVSS score of 5.5 (MEDIUM). The VPN service in AVAST SecureLine before 5.6.4982.470 allows local users to write to arbitrary files via an Object Manager symbolic link from the log directory (which has weak permissions).
How severe is CVE-2020-25289?
CVE-2020-25289 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-25289?
Check the references section above for vendor advisories and patch information. Affected products include: Avast Secureline Vpn.