CVE-2019-3744: dell alienware digital delivery Path Traversal

Vulnerability summary

CVE-2019-3744 is a high (CVSS 7.8) Path Traversal vulnerability in dell alienware digital delivery. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.6% of scored vulnerabilities.

Timeline

1. 09-08-2019
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Dell/Alienware Digital Delivery versions prior to 4.0.41 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a Universal Windows Platform application by manipulating the install software package feature with a race condition and a path traversal exploit in order to run a malicious executable with elevated privileges.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.