CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 9.3
CWE Name:  Permissions Privileges and Access Controls
Summary: untrusted search path vulnerability in the microsoft foundation class (mfc) library in microsoft visual studio .net 2003 sp1; visual studio 2005 sp1, 2008 sp1, and 2010; visual c++ 2005 sp1, 2008 sp1, and 2010; and exchange server 2010 service pack 3, 2013, and 2013 allows local users to gain privileges via a trojan horse dwmapi.dll file in the current working directory during execution of an mfc application such as atltracetool8.exe (aka atl mfc trace tool), as demonstrated by a directory that contains a trc, cur, rs, rct, or res file, aka "mfc insecure library loading vulnerability." per: https://technet.microsoft.com/en-us/security/bulletin/ms11-025 access vector: network per "this is a remote code execution vulnerability" per: http://cwe.mitre.org/data/definitions/426.html

cwe-426: untrusted search path
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2010-08-31
Last Modified Date: 2018-10-10