CVE-2022-23909

· HIGHModified

← All CVEs

CVSS v3.1

7.8

EPSS

1.03%

Published

Apr 5, 2022

Modified

Nov 21, 2024

Public PoC / Exploit (2)

All weaponized →

TrickestTrickest PoC index Exploit-DBSherpa Connector Service v2020.2.20328.2050 - Unquoted Service Path

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This might allow a local user to escalate privileges by creating a "C:\Program Files\Sherpa Software\Sherpa.exe" file.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-428

Affected Products (2)

gimmal · sherpa_connector_servicevulnerable

microsoft · windows

References (4)

http://packetstormsecurity.com/files/166574/Sherpa-Connector-Service-2020.2.20328.2050-Unquoted-Service-Path.html

ExploitThird Party AdvisoryVDB Entry

https://github.com/netsectuna/CVE-2022-23909

ExploitThird Party Advisory

http://packetstormsecurity.com/files/166574/Sherpa-Connector-Service-2020.2.20328.2050-Unquoted-Service-Path.html

ExploitThird Party AdvisoryVDB Entry

https://github.com/netsectuna/CVE-2022-23909

ExploitThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs