CVE-2019-8452: check point zonealarm check point endpoint security client for windows Windows Hard Link
Vulnerability summary
CVE-2019-8452 is a high (CVSS 7.8) Windows Hard Link vulnerability in check point zonealarm check point endpoint security client for windows. EPSS estimates a 1.04% chance of exploitation in the next 30 days, higher than 63.3% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 22-04-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security client for Windows before E80.96 to any file on the system will get its permission changed so that all users can access that linked file. Doing this on files with limited access gains the local attacker higher privileges to the file.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.04%
Chance of exploitation in the next 30 days
Percentile
63%
Versus all other CVEs
30-day change
0.00 pp
From 1.04% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
CheckPoint Endpoint Security Client/ZoneAlarm 15.4.062.17802 - Privilege Escalation
Maturity: poc
Weaknesses
CWE · root cause- CWE-65Windows Hard LinkThe product, when opening a file or directory, does not sufficiently handle when the name is associated with a hard link to a target that is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
- CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Affected systems
Check point zonealarm2 products
- check point endpoint security client for windowsCheck Point Endpoint Security client for Windows before E80.96
- check point zonealarmCheck Point ZoneAlarm up to 15.4.062
Checkpoint2 products
- endpoint_security< e80.96
- zonealarm≤ 15.4.062
2 vendors · 4 products