CVE-2022-28225 in Yandex

Résumé

par MITRE • 16/06/2022

Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.684 allows a local, low privileged, attacker to execute arbitary code with the SYSTEM privileges through manipulating symlinks to installation file during Yandex Browser update process.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Réserver: 30/03/2022
• Divulgation: 16/06/2022
• Modérer: accepté
• Entrée: VDB-202218
• CPE: prêt
• CWE: CWE-61 (confirmé)
• CVSS: 8.8 (VulDB)
• EPSS: 0.00466
• KEV: non
• Activités: très faible

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2022-28225
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-28225
• CVE Details: https://www.cvedetails.com/cve/CVE-2022-28225/