CVE-2020-18171: High severity Techsmith Snagit vulnerability

Published Jul 26, 2021

Updated

DISPUTED TechSmith Snagit 19.1.0.2653 uses Object Linking and Embedding (OLE) which can allow attackers to obfuscate and embed crafted files used to escalate privileges. NOTE: This implies that Snagit's use of OLE is a security vulnerability unto itself and it is not. See reference document for more details.

Affected Software

4 affected components

All of the following

Techsmith Snagit=19.1.0.2653

Microsoft Windows

Techsmith Snagit=19.1.0.2653

Microsoft Windows

Event History

Jul 26, 2021

CVE Published

via MITRE·06:26 PM

Data Sourced

via MITRE·06:26 PM

Description

Disputed

08:15 PM

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2020-18171?

CVE-2020-18171 has been disputed, suggesting that the use of OLE in Snagit is not inherently a security vulnerability.

How do I fix CVE-2020-18171?

To address CVE-2020-18171, ensure you are using the latest version of TechSmith Snagit, if available.

What affects CVE-2020-18171?

CVE-2020-18171 specifically affects TechSmith Snagit version 19.1.0.2653.

Can CVE-2020-18171 lead to privilege escalation?

Yes, CVE-2020-18171 can allow attackers to embed crafted files through OLE, which could potentially lead to privilege escalation.

Is OLE usage in Snagit a direct security vulnerability according to CVE-2020-18171?

CVE-2020-18171 is disputed on the grounds that the use of OLE by Snagit itself might not constitute a direct security vulnerability.