CVE-2020-12612
First published: Tue Dec 12 2023(Updated: )
An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. When specifying a program to elevate, it can typically be found within the Program Files (x86) folder and therefore uses the %ProgramFiles(x86)% environment variable. However, when this same policy gets pushed to a 32bit machine, this environment variable does not exist. Therefore, since the standard user can create a user level environment variable, they can repoint this variable to any folder the user has full control of. Then, the folder structure can be created in such a way that a rule matches and arbitrary code runs elevated.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| BeyondTrust Privilege Management for Windows | <5.6 | |
| BeyondTrust Privilege Management for Windows | =5.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-12612?
CVE-2020-12612 has a medium severity rating, which indicates it poses a potential risk to affected systems.
How do I fix CVE-2020-12612?
To fix CVE-2020-12612, upgrade BeyondTrust Privilege Management for Windows to version 5.6 or later.
What systems are affected by CVE-2020-12612?
CVE-2020-12612 affects versions of BeyondTrust Privilege Management for Windows prior to version 5.6.
What is the nature of the vulnerability described in CVE-2020-12612?
CVE-2020-12612 involves a flaw in the environment variable handling when policies for elevating programs are applied.
Is there a workaround for CVE-2020-12612 if I cannot update?
Currently, there are no documented workarounds for CVE-2020-12612, so upgrading is recommended.
- collector/nvd-api
- agent/references
- agent/event
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/tags
- agent/description
- agent/source
- vendor/beyondtrust
- canonical/beyondtrust privilege management for windows
- version/beyondtrust privilege management for windows/5.6