CWE Code: 428
Vulnerability Type: privilege_escalation
CVSS Score: 6.9
CWE Name:  Unquoted Search Path or Element
Summary: net monitor for employees pro through 5.3.4 has an unquoted service path, which allows a security feature bypass of its documented "block applications" design goal. the local attacker must have privileges to write to program.exe in a protected directory, such as the %systemdrive% directory, and thus the issue is not interpreted as a direct privilege escalation. however, the local attacker might have the goal of executing program.exe even though program.exe is a blocked application.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: LOCAL
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2017-06-08
Last Modified Date: 2019-10-03