CVE-2019-13382: Critical severity techsmith vulnerability

Published Jul 26, 2019

Updated

UploaderService in SnagIT 2019.1.2 allows elevation of privilege by placing an invalid presentation file in %PROGRAMDATA%\TechSmith\TechSmith Recorder\QueuedPresentations and then creating a symbolic link in %PROGRAMDATA%\Techsmith\TechSmith Recorder\InvalidPresentations that points to an arbitrary folder with an arbitrary file name. TechSmith Relay Classic Recorder prior to 5.2.1 on Windows is vulnerable. The vulnerability was introduced in SnagIT Windows 12.4.1.

Affected Software

2 affected components

Techsmith Snagit=2019.1.2

Microsoft Windows

Event History

Jul 26, 2019

CVE Published

via MITRE·12:25 PM

Data Sourced

via MITRE·12:25 PM

Description

Frequently Asked Questions

What is the severity of CVE-2019-13382?

CVE-2019-13382 is rated as a medium severity vulnerability due to its potential for privilege escalation.

How do I fix CVE-2019-13382?

To mitigate CVE-2019-13382, users should upgrade to SnagIT version 2019.1.3 or later, which resolves this vulnerability.

Who is affected by CVE-2019-13382?

CVE-2019-13382 affects users of SnagIT version 2019.1.2 running on any version of Microsoft Windows.

What type of vulnerability is CVE-2019-13382?

CVE-2019-13382 is a local privilege escalation vulnerability that allows an attacker to gain elevated permissions.

Can CVE-2019-13382 be exploited remotely?

CVE-2019-13382 cannot be exploited remotely; it requires local access to the affected system.