« Volver al listado

CVE-2020-15723

Estado: En análisisAlta (7.8)—

In the version 12.1.0.1004 and below of 360 Total Security, when the main process of 360 Total Security calls GameChrome.exe, there exists a local privilege escalation vulnerability. An attacker who could exploit DLL hijacking to bypass the hips could execute arbitrary code on the Local system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

360totalsecurity — 360 Total Security

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-15723",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.9,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@360.cn",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "360 Total Security",
          "versions": [
            {
              "status": "affected",
              "version": "12.1.0.1004"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-07-21T18:15:20.067",
  "references": [
    {
      "url": "https://security.360.cn/News/news/id/232",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@360.cn"
    },
    {
      "url": "https://security.360.cn/News/news/id/232",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-427"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the version 12.1.0.1004 and below of 360 Total Security, when the main process of 360 Total Security calls GameChrome.exe, there exists a local privilege escalation vulnerability. An attacker who could exploit DLL hijacking to bypass the hips could execute arbitrary code on the Local system."
    },
    {
      "lang": "es",
      "value": "En 360 ??Total Security versión 12.1.0.1004 y por debajo, cuando el proceso principal de 360 ??Total Security llama al archivo GameChrome.exe, se presenta una vulnerabilidad de escalada de privilegios local. Un atacante que podría explotar el secuestro de DLL para omitir los HIPS podría ejecutar código arbitrario en el sistema local"
    }
  ],
  "lastModified": "2026-06-17T02:57:07.597",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:360totalsecurity:360_total_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D275F40A-818B-4D1A-955A-7A9CBB49CDA0",
              "versionEndIncluding": "12.1.0.1004"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@360.cn"
}