CVE-2023-37907

HighCVSS 7.0

Published: 25/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

Risk Assessment

The problem occurs as the repair function of the MSI spawns two administrative CMDs, allowing for a simple LPE. This could lead to unauthorized access to the system.

Recommendation

It is recommended to upgrade to version 1.9.2 to mitigate this vulnerability. Users should also consider restricting access to the MSI installer.

Other vulnerabilities in Cryptomator MSI installer

CVE-2023-39520Medium
Cryptomator version 1.9.2 allows local privilege escalation for low privileged users via the `repair` function in the MSI installer. The issue arises from the MSI's repair function spawning a SYSTEM Powershell without the `-NoProfile` parameter, leading to the loading of the user's profile.

Original NVD description (English source)

Cryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homepage allows local privilege escalation (LPE) for low privileged users, if already installed. The problem occurs as the repair function of the MSI spawns two administrative CMDs. A simple LPE is possible via a breakout. Version 1.9.2 fixes this issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS