Vulnerability in Microsoft Windows
CVE-2019-13382
UploaderService in SnagIT 2019.1.2 allows elevation of privilege by placing an invalid presentation file in %PROGRAMDATA%\TechSmith\TechSmith Recorder\QueuedPresentations and then creating a symbolic link in %PROGRAMDATA%\Techsmith\TechSmith Recorder\InvalidPresentations that points to an arbitrary folder with an arbitrary file name. TechSmith Relay Classic Recorder prior to 5.2.1 on Windows is vulnerable. The vulnerability was introduced in SnagIT Windows 12.4.1.
EPSS: 0.016 (72.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Microsoft Windows
- Techsmith Snagit — versions 2019.1.2
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
- cve@mitre.org (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2019-13382?
- CVE-2019-13382 is a high-severity vulnerability in Microsoft Windows, classified under Improper Link Resolution Before File Access. CVSS score: 7.8/10. Published 2019-07-26.
- How severe is CVE-2019-13382?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2019-13382 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.