CVE-2015-7378

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-7378
Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and installed files, which allows local users to gain SYSTEM privileges by modifying Panda_URL_Filteringb.exe.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://packetstormsecurity.com/files/136607/Panda-Security-URL-Filtering-Privilege-Escalation.html Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2016/Apr/25 Mailing List Third Party Advisory
https://www.exploit-db.com/exploits/39670/ Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/136607/Panda-Security-URL-Filtering-Privilege-Escalation.html Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2016/Apr/25 Mailing List Third Party Advisory
https://www.exploit-db.com/exploits/39670/ Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:watchguard:panda_url_filtering:*:*:*:*:*:*:*:*
History

21 Nov 2024, 02:36

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/136607/Panda-Security-URL-Filtering-Privilege-Escalation.html - Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/136607/Panda-Security-URL-Filtering-Privilege-Escalation.html - Third Party Advisory, VDB Entry
References () http://seclists.org/fulldisclosure/2016/Apr/25 - Mailing List, Third Party Advisory () http://seclists.org/fulldisclosure/2016/Apr/25 - Mailing List, Third Party Advisory
References () https://www.exploit-db.com/exploits/39670/ - Third Party Advisory, VDB Entry () https://www.exploit-db.com/exploits/39670/ - Third Party Advisory, VDB Entry

09 Sep 2021, 17:31

Type Values Removed Values Added
CWE CWE-254 CWE-276
CPE cpe:2.3:a:pandasecurity:panda_security_url_filtering:*:*:*:*:*:*:*:* cpe:2.3:a:watchguard:panda_url_filtering:*:*:*:*:*:*:*:*
References (MISC) http://packetstormsecurity.com/files/136607/Panda-Security-URL-Filtering-Privilege-Escalation.html - (MISC) http://packetstormsecurity.com/files/136607/Panda-Security-URL-Filtering-Privilege-Escalation.html - Third Party Advisory, VDB Entry
References (FULLDISC) http://seclists.org/fulldisclosure/2016/Apr/25 - (FULLDISC) http://seclists.org/fulldisclosure/2016/Apr/25 - Mailing List, Third Party Advisory
References (EXPLOIT-DB) https://www.exploit-db.com/exploits/39670/ - (EXPLOIT-DB) https://www.exploit-db.com/exploits/39670/ - Third Party Advisory, VDB Entry
Information

Published : 2016-04-18 15:59

Updated : 2025-04-12 10:46

NVD link : CVE-2015-7378

Mitre link : CVE-2015-7378

CVE.ORG link : CVE-2015-7378

JSON object : View

Products Affected

watchguard

  • panda_url_filtering
CWE
CWE-276

Incorrect Default Permissions