CVE-2019-8461: checkpoint capsule_docs_standalone_client Process Control

Vulnerability summary

CVE-2019-8461 is a high (CVSS 7.8) Process Control vulnerability in checkpoint capsule_docs_standalone_client. EPSS estimates a 1.12% chance of exploitation in the next 30 days, higher than 65.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 29-08-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH location on a clean image without Endpoint Client installed. An attacker can leverage this to gain LPE using a specially crafted DLL placed in any PATH location accessible with write permissions to the user.

• CWE-114Process ControlExecuting commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker.
• CWE-426Untrusted Search PathThe product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.