Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-6141
CVE-2024-6141:
Windscribe vulnerability analysis and mitigation
Overview
CVE-2024-6141 is a directory traversal local privilege escalation vulnerability affecting Windscribe installations. The vulnerability was discovered by Zeze Lin working with Trend Micro Zero Day Initiative and was disclosed on June 20th, 2024. The vulnerability affects Windscribe desktop application versions prior to 2.10.10 (ZDI Advisory).
Technical details
The vulnerability exists within the Windscribe Service component and stems from insufficient validation of user-supplied paths during file operations. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) with the vector string AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The flaw is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) (NVD, ZDI Advisory).
Impact
An attacker who successfully exploits this vulnerability can escalate privileges and execute arbitrary code in the context of SYSTEM on the affected system. This could lead to complete system compromise (ZDI Advisory).
Mitigation and workarounds
Windscribe has addressed this vulnerability in version 2.10.10, released on May 15, 2024. Users are advised to update to this version or later. The fix specifically addresses the privilege escalation vulnerability that allowed an attacker to inject a DLL into the client app (Windscribe Changelog).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management