High severity · published Jun 11, 2020
CVE-2020-11613
Mids' Reborn Hero Designer 2.6.0.7 has an elevation of privilege vulnerability due to default and insecure permissions being set for the installation folder
7.8
CVSS
0.5%
EPSS
No
On KEV
Description
Mids' Reborn Hero Designer 2.6.0.7 has an elevation of privilege vulnerability due to default and insecure permissions being set for the installation folder. By default, the Authenticated Users group has Modify permissions to the installation folder. Because of this, any user on the system can replace binaries or plant malicious DLLs to obtain elevated, or different, privileges, depending on the context of the user that runs the application.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MR
Mids' Reborn Hero Designer · Mids' Reborn Hero Designer Project
2.6.0.7 · source: NVD
Affected product
MR
Mids' Reborn Hero Designer
Mids' Reborn Hero Designer Project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11613
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11613
Release Notes
https://github.com/Crytilis/mids-reborn-hero-designer/releases
Exploit
https://www.doyler.net/security-not-included/mids-reborn-vulnerabilities
More from Mids' Reborn Hero Designer
8.1
CVE-2020-11614
Mids' Reborn Hero Designer 2.6.0.7 downloads the update manifest, as well as update files, over cleartext HTTP