« Volver al listado

CVE-2020-25045

Estado: ModificadaAlta (7.8)—

Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges in the system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Kaspersky — Security CenterKaspersky — Security Center WEB Console

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-25045",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.4,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "vulnerability@kaspersky.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Kaspersky Security Center & Kaspersky Security Center Web Console",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 12 & prior to 12 Patch A"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-09-02T20:15:10.827",
  "references": [
    {
      "url": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#290720",
      "tags": [
        "Broken Link"
      ],
      "source": "vulnerability@kaspersky.com"
    },
    {
      "url": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#290720",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-427"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges in the system."
    },
    {
      "lang": "es",
      "value": "Los instaladores de Kaspersky Security Center y Kaspersky Security Center Web Console versiones anteriores a 12 y anteriores a 12 Parche A, eran vulnerables a un ataque de secuestro de DLL que permitía a un atacante elevar los privilegios en el sistema"
    }
  ],
  "lastModified": "2026-06-17T03:06:17.210",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:kaspersky:security_center:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4AECCD55-C81B-4233-867D-4A30CE246215",
              "versionEndExcluding": "12"
            },
            {
              "criteria": "cpe:2.3:a:kaspersky:security_center_web_console:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8682082F-2BC0-489F-B5FD-E4B382C86B3E",
              "versionEndExcluding": "12"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vulnerability@kaspersky.com"
}