CVE-2020-15261

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malicious executables with LocalSystem privileges. Since Veyon users (both students and teachers) usually don't have administrative privileges, this vulnerability is only dangerous in anyway unsafe setups. The problem has been fixed in version 4.4.2. As a workaround, the exploitation of the vulnerability can be prevented by revoking administrative privileges from all potentially untrustworthy users.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-428

Affected software

Vendor	Product	Versions
veyon	veyon	< 0.11.5

References

http://packetstormsecurity.com/files/162873/Veyon-4.4.1-Unquoted-Service-Path.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/veyon/veyon/commit/f231ec511b9a09f43f49b2c7bb7c60b8046276b1Patch, Third Party Advisory
https://github.com/veyon/veyon/issues/657Issue Tracking, Third Party Advisory
https://github.com/veyon/veyon/security/advisories/GHSA-c8cc-x786-hqqpThird Party Advisory
https://www.exploit-db.com/exploits/48246Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/49925Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/162873/Veyon-4.4.1-Unquoted-Service-Path.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/veyon/veyon/commit/f231ec511b9a09f43f49b2c7bb7c60b8046276b1Patch, Third Party Advisory
https://github.com/veyon/veyon/issues/657Issue Tracking, Third Party Advisory
https://github.com/veyon/veyon/security/advisories/GHSA-c8cc-x786-hqqpThird Party Advisory
https://www.exploit-db.com/exploits/48246Exploit, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/49925Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Oct 19, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-152623.7In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by th CVE-2020-152636.1In platform before version 9.4.4, inline attributes are not properly escaped. If the data that came from users was not escaped, then an XSS CVE-2020-152647.8The Boxstarter installer before version 2.13.0 configures C:\ProgramData\Boxstarter to be in the system-wide PATH environment variable. Howe CVE-2020-152657.5In Tensorflow before version 2.4.0, an attacker can pass an invalid `axis` value to `tf.quantization.quantize_and_dequantize`. This results CVE-2020-152667.5In Tensorflow before version 2.4.0, when the `boxes` argument of `tf.image.crop_and_resize` has a very large value, the CPU kernel implement CVE-2020-152699.1In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is pat CVE-2020-15277.8An elevation of privilege vulnerability exists when the Windows Custom Protocol Engine improperly handles memory. To exploit this vulnerabil CVE-2020-152704.3Parse Server (npm package parse-server) broadcasts events to all clients without checking if the session token is valid. This allows clients CVE-2020-152718.8In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and "file_loader" extens CVE-2020-152729.6In the git-tag-annotation-action (open source GitHub Action) before version 1.0.1, an attacker can execute arbitrary (*) shell commands if t CVE-2020-152738.1baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit wi CVE-2020-152745.4In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results. While the title is pr