1. Home
  2. CVE Database
  3. CVE-2022-24618
HIGH · 7.8

CVE-2022-24618

Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unprivileged local users to elevate privileges to SYSTEM via the "Browse For Folder"...

Vulnerability Description

Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unprivileged local users to elevate privileges to SYSTEM via the "Browse For Folder" window accessible by triggering a "Repair" on the MSI package located in C:\Windows\Installer.

CVSS Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
HeimdalsecurityHeimdal Premium Security< 2.5.398

Related Weaknesses (CWE)

CWE-281

References

FAQ

What is CVE-2022-24618?

CVE-2022-24618 is a vulnerability with a CVSS score of 7.8 (HIGH). Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unprivileged local users to elevate privileges to SYSTEM via the "Browse For Folder"...

How severe is CVE-2022-24618?

CVE-2022-24618 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-24618?

Check the references section above for vendor advisories and patch information. Affected products include: Heimdalsecurity Heimdal Premium Security.