Vulnerability in Sepppenner Windowshello
CVE-2020-11005
The WindowsHello open source library (NuGet HaemmerElectronics.SeppPenner.WindowsHello), before version 1.0.4, has a vulnerability where encrypted data could potentially be decrypted without needing authentication. If the library is used to encrypt text and write the output to a txt file, another executable could be able to decrypt the text using the static method NCryptDecrypt from this same library without the need to use Windows Hello Authentication again. This has been patched in version 1.0.4.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.1 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.002 (12.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 13th percentile — 12.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Sepppenner Windowshello — versions < 1.0.4
- Windowshello Project
Weakness classification (CWE)
References
- github.com/SeppPenner/WindowsHello/security/advisories/GHSA-wvpv-ffcv-r6cw (Third Party Advisory)
- github.com/SeppPenner/WindowsHello/issues/3 (Third Party Advisory, Issue Tracking)
Frequently asked questions
- What is CVE-2020-11005?
- CVE-2020-11005 is a medium-severity vulnerability in Sepppenner Windowshello, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 5.1/10. Published 2020-04-14.
- How severe is CVE-2020-11005?
- Medium severity. CVSS v3 base score is 5.1 out of 10.