CVE-2020-12613
First published: Mon Dec 11 2023(Updated: )
An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. An attacker can spawn a process with multiple users as part of the security token (prior to Avecto elevation). When Avecto elevates the process, it removes the user who is launching the process, but not the second user. Therefore this second user still retains access and can give permission to the process back to the first user.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| BeyondTrust Privilege Management | <=5.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-12613?
CVE-2020-12613 has been classified as a high severity vulnerability due to potential exploitation leading to process elevation.
How do I fix CVE-2020-12613?
To fix CVE-2020-12613, upgrade BeyondTrust Privilege Management for Windows to version 5.6 or later.
What impact does CVE-2020-12613 have on affected systems?
CVE-2020-12613 allows attackers to elevate privileges by spawning a process with multiple user tokens, potentially leading to unauthorized access.
Which versions of BeyondTrust Privilege Management for Windows are affected by CVE-2020-12613?
CVE-2020-12613 affects all versions of BeyondTrust Privilege Management for Windows up to and including version 5.6.
Is there a workaround for CVE-2020-12613 until I can update?
Currently, there are no published workarounds for CVE-2020-12613, so it is recommended to apply the available updates as soon as possible.
- agent/type
- agent/references
- agent/event
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- vendor/beyondtrust
- canonical/beyondtrust privilege management
- version/beyondtrust privilege management/5.6