CVE-2023-37907

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation (LPE) for low privileged users, if already installed. The problem occurs as the repair function of the MSI spawns two administrative CMDs. A simple LPE is possible via a breakout. Version 1.9.2 fixes this issue.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Jul 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-379089.6XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. The cleaning of attributes CVE-2023-379098.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.1-rc-1 and pr CVE-2023-37919.8A vulnerability was found in IBOS OA 4.5.5 and classified as critical. Affected by this issue is the function actionExport of the file ?r=co CVE-2023-379108.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with the introduction of a CVE-2023-379116.5XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 9.4-rc-1 and pr CVE-2023-379128.8XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. Prior to version 14.10.6 of CVE-2023-379138.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 3.5-milestone-1 CVE-2023-379148.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can view `Invitation.W CVE-2023-379157.5OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). OpenDDS crashes while par CVE-2023-379167.5KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of a CVE-2023-379178.8KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing t CVE-2023-379187.5Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. A vulnerability has been found in Dap