high7.8Public exploit code
CVE-2022-23909
There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Sherpa Connector Service v2020.2.20328.2050 - Unquoted Service Path2022-04-07 · local · windows
Impact
There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This might allow a local user to escalate privileges by creating a "C:\Program Files\Sherpa Software\Sherpa.exe" file.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gimmal | Sherpa Connector Service | Version 2020.2.20328.2050 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/166574/Sherpa-Connector-Service-2020.2.20328.2050-Unquoted-Service-Path.html
- https://github.com/netsectuna/CVE-2022-23909
- http://packetstormsecurity.com/files/166574/Sherpa-Connector-Service-2020.2.20328.2050-Unquoted-Service-Path.html
- https://github.com/netsectuna/CVE-2022-23909