CVE-2020-11541: 
Homebrew vulnerability analysis and mitigation

In TechSmith SnagIt versions 11.2.1 through 20.0.3, an XML External Entity (XXE) injection vulnerability was discovered. This security issue was assigned CVE-2020-11541 and was publicly disclosed on May 8, 2020. The vulnerability affects the Windows versions of the SnagIt software, a popular screen capture and recording tool (NVD).

The vulnerability is classified as an XML External Entity (XXE) injection issue (CWE-611). According to the CVSS v3.1 scoring system, it received a base score of 5.5 (MEDIUM), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. Under CVSS v2.0, it was rated at 2.1 (LOW) with the vector (AV:L/AC:L/Au:N/C:P/I:N/A:N). The scoring indicates that the vulnerability requires local access and low complexity to exploit (NVD).

The vulnerability allows a local attacker to exfiltrate data under the local Administrator account. This means an attacker with local access to the system could potentially access sensitive information that should be restricted to administrator-level users (NVD).

The vulnerability requires local access to exploit, meaning an attacker would need physical access or local user access to the affected system. The attack complexity is considered low, indicating that the vulnerability is relatively straightforward to exploit once local access is obtained (NVD).

TechSmith addressed this vulnerability by releasing version 20.1.1 of SnagIt. Users running affected versions (11.2.1 through 20.0.3) should upgrade to version 20.1.1 or later to mitigate this security risk (Vendor Advisory).