CVE-2020-24356: Local Privilege Escalation in cloudflared
First published: Fri Oct 02 2020(Updated: )
`cloudflared` versions prior to 2020.8.1 contain a local privilege escalation vulnerability on Windows systems. When run on a Windows system, `cloudflared` searches for configuration files which could be abused by a malicious entity to execute commands as a privileged user. Version 2020.8.1 fixes this issue.
Credit: cna@cloudflare.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cloudflare Cloudflared | <2020.8.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2020-24356.
What is the severity of CVE-2020-24356?
The severity of CVE-2020-24356 is high.
What is the affected software for CVE-2020-24356?
The affected software for CVE-2020-24356 is cloudflared versions prior to 2020.8.1.
How can the vulnerability CVE-2020-24356 be exploited?
The vulnerability CVE-2020-24356 can be exploited by a malicious entity to execute commands as a privileged user on Windows systems.
How do I fix CVE-2020-24356?
To fix CVE-2020-24356, update cloudflared to version 2020.8.1 or newer.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/title
- agent/severity
- agent/author
- agent/references
- agent/weakness
- agent/description
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- vendor/cloudflare
- canonical/cloudflare cloudflared