CWE Code: 427
Vulnerability Type: privilege_escalation
CVSS Score: 6.8
CWE Name:  Uncontrolled Search Path Element
Summary: exiftool 8.32 allows local users to gain privileges by creating a %temp%\par-%username%\cache-exiftool-8.32 folder with a victim's username, and then copying a trojan horse ws32_32.dll file into this new folder, aka dll hijacking.  note: 8.32 is an obsolete version from 2010 (9.x was released starting in 2012, and 10.x was released starting in 2015).
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2019-01-02
Last Modified Date: 2019-01-11