High severityNVD Advisory· Published Oct 2, 2020· Updated Sep 17, 2024

Local Privilege Escalation in cloudflared

CVE-2020-24356

Description

cloudflared versions prior to 2020.8.1 contain a local privilege escalation vulnerability on Windows systems. When run on a Windows system, cloudflared searches for configuration files which could be abused by a malicious entity to execute commands as a privileged user. Version 2020.8.1 fixes this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/cloudflare/cloudflaredGo	< 0.0.0-20200820025921-9323844ea773	0.0.0-20200820025921-9323844ea773

Affected products

ghsa-coords
pkg:golang/github.com/cloudflare/cloudflared
Range: < 0.0.0-20200820025921-9323844ea773
Cloudflare/cloudflaredv5
Range: unspecified

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-hgwp-4vp4-qmm2ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2020-24356ghsaADVISORY
github.com/cloudflare/cloudflared/commit/9323844ea773b1444460fa09295ab8c01a88d97eghsaWEB
github.com/cloudflare/cloudflared/security/advisories/GHSA-hgwp-4vp4-qmm2ghsax_refsource_CONFIRMWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000