CVE-2024-6141

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-6141

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6141.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-6141

Published

2024-08-21T16:10:55.914Z

Modified

2026-07-15T01:49:16.077665105Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Windscribe Directory Traversal Local Privilege Escalation Vulnerability

Details

Windscribe Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Windscribe. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the Windscribe Service. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23441.

Database specific

{
    "cna_assigner": "zdi",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6141.json",
    "cwe_ids": [
        "CWE-22"
    ],
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "2.9.9.0"
                },
                {
                    "last_affected": "2.9.9.0"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/windscribe/desktop-app

Affected ranges

Type

GIT

Repo

https://github.com/windscribe/desktop-app

Events

Introduced

bc84faf99c5f08b4b6b310fadf9a40eaadbdb771

Last affected

bc84faf99c5f08b4b6b310fadf9a40eaadbdb771

Database specific

{
    "cpe": "cpe:2.3:a:windscribe:windscribe:2.9.9:*:*:*:*:windows:*:*",
    "extracted_events": [
        {
            "introduced": "2.9.9"
        },
        {
            "last_affected": "2.9.9"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

2.*

2.9.9

v2.*

v2.9.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6141.json"