Pritunl Client up to 1.2.3019.52 on Windows ACL platform_windows.go access control

Summaryinfo

A vulnerability marked as critical has been reported in Pritunl Client up to 1.2.3019.52 on Windows. Impacted is an unknown function of the file platform_windows.go of the component ACL. This manipulation causes access control. This vulnerability is handled as CVE-2022-25372. The attack can be initiated remotely. There is not any exploit available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in Pritunl Client up to 1.2.3019.52 on Windows. It has been declared as critical. Affected by this vulnerability is an unknown code of the file platform_windows.go of the component ACL. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was released 02/21/2022 as e16d47437f8ef62546aa00edb0d64be2a7d2205b. The advisory is shared at github.com. This vulnerability is known as CVE-2022-25372 since 02/20/2022. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Applying the patch e16d47437f8ef62546aa00edb0d64be2a7d2205b is able to eliminate this problem. The bugfix is ready for download at github.com.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Pritunl

Name

• Client

Version

• 1.2.3019.0
• 1.2.3019.1
• 1.2.3019.2
• 1.2.3019.3
• 1.2.3019.4
• 1.2.3019.5
• 1.2.3019.6
• 1.2.3019.7
• 1.2.3019.8
• 1.2.3019.9
• 1.2.3019.10
• 1.2.3019.11
• 1.2.3019.12
• 1.2.3019.13
• 1.2.3019.14
• 1.2.3019.15
• 1.2.3019.16
• 1.2.3019.17
• 1.2.3019.18
• 1.2.3019.19
• 1.2.3019.20
• 1.2.3019.21
• 1.2.3019.22
• 1.2.3019.23
• 1.2.3019.24
• 1.2.3019.25
• 1.2.3019.26
• 1.2.3019.27
• 1.2.3019.28
• 1.2.3019.29
• 1.2.3019.30
• 1.2.3019.31
• 1.2.3019.32
• 1.2.3019.33
• 1.2.3019.34
• 1.2.3019.35
• 1.2.3019.36
• 1.2.3019.37
• 1.2.3019.38
• 1.2.3019.39
• 1.2.3019.40
• 1.2.3019.41
• 1.2.3019.42
• 1.2.3019.43
• 1.2.3019.44
• 1.2.3019.45
• 1.2.3019.46
• 1.2.3019.47
• 1.2.3019.48
• 1.2.3019.49
• 1.2.3019.50
• 1.2.3019.51
• 1.2.3019.52

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion