CVE-2021-35052 - Vulnerability Details

Vendors	Products
Kaspersky	Password Manager

Link	Providers
https://support.kaspersky.com/general/vulnerability.aspx?el=12430#221121
https://www.zerodayinitiative.com/advisories/ZDI-21-1335/

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "Kaspersky Password Manager for Windows", "vendor": "n/a", "versions": [{"status": "affected", "version": "KPM for Windows prior to 9.0.2 Patch R"}]}], "descriptions": [{"lang": "en", "value": "A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High."}], "problemTypes": [{"descriptions": [{"description": "LPE", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-11-29T10:06:04", "orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988", "shortName": "Kaspersky"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#221121"}, {"tags": ["x_refsource_MISC"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1335/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "vulnerability@kaspersky.com", "ID": "CVE-2021-35052", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Kaspersky Password Manager for Windows", "version": {"version_data": [{"version_value": "KPM for Windows prior to 9.0.2 Patch R"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "LPE"}]}]}, "references": {"reference_data": [{"name": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#221121", "refsource": "MISC", "url": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#221121"}, {"name": "https://www.zerodayinitiative.com/advisories/ZDI-21-1335/", "refsource": "MISC", "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1335/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T00:33:50.733Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#221121"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1335/"}]}]}, "cveMetadata": {"assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988", "assignerShortName": "Kaspersky", "cveId": "CVE-2021-35052", "datePublished": "2021-11-23T15:30:38", "dateReserved": "2021-06-18T00:00:00", "dateUpdated": "2024-08-04T00:33:50.733Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : Kaspersky Password Manager for Windows (string)

vendor : n/a (string)

versions : [ »

0 : { »

status : affected (string)

version : KPM for Windows prior to 9.0.2 Patch R (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : LPE (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2021-11-29T10:06:04 (string)

orgId : e45d732a-8f6b-4b6b-be76-7420f6a2b988 (string)

shortName : Kaspersky (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://support.kaspersky.com/general/vulnerability.aspx?el=12430#221121 (string)

}

1 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://www.zerodayinitiative.com/advisories/ZDI-21-1335/ (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : vulnerability@kaspersky.com (string)

ID : CVE-2021-35052 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : Kaspersky Password Manager for Windows (string)

version : { »

version_data : [ »

0 : { »

version_value : KPM for Windows prior to 9.0.2 Patch R (string)

}

]

}

]

}

vendor_name : n/a (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : LPE (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://support.kaspersky.com/general/vulnerability.aspx?el=12430#221121 (string)

refsource : MISC (string)

url : https://support.kaspersky.com/general/vulnerability.aspx?el=12430#221121 (string)

}

1 : { »

name : https://www.zerodayinitiative.com/advisories/ZDI-21-1335/ (string)

refsource : MISC (string)

url : https://www.zerodayinitiative.com/advisories/ZDI-21-1335/ (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-04T00:33:50.733Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://support.kaspersky.com/general/vulnerability.aspx?el=12430#221121 (string)

}

1 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://www.zerodayinitiative.com/advisories/ZDI-21-1335/ (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : e45d732a-8f6b-4b6b-be76-7420f6a2b988 (string)

assignerShortName : Kaspersky (string)

cveId : CVE-2021-35052 (string)

datePublished : 2021-11-23T15:30:38 (string)

dateReserved : 2021-06-18T00:00:00 (string)

dateUpdated : 2024-08-04T00:33:50.733Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kaspersky:password_manager:*:*:*:*:*:windows:*:*", "matchCriteriaId": "A0AC120D-32C3-4E83-BB9D-4C69C18E1368", "versionEndIncluding": "9.0.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:kaspersky:password_manager:9.0.2:-:*:*:*:windows:*:*", "matchCriteriaId": "058CA841-D966-46FD-81BB-17D931E24420", "vulnerable": true}, {"criteria": "cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_a:*:*:*:windows:*:*", "matchCriteriaId": "32B9179B-8F61-40AB-9926-3947AAE46A0D", "vulnerable": true}, {"criteria": "cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_b:*:*:*:windows:*:*", "matchCriteriaId": "558298F8-F5E4-4B77-90BB-A51B12863E69", "vulnerable": true}, {"criteria": "cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_c:*:*:*:windows:*:*", "matchCriteriaId": "61D1CE9D-159A-496D-AEB9-2C454C4B2986", "vulnerable": true}, {"criteria": "cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_d:*:*:*:windows:*:*", "matchCriteriaId": "DD963F57-EF5F-436C-A696-83B98F03AA76", "vulnerable": true}, {"criteria": "cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_e:*:*:*:windows:*:*", "matchCriteriaId": "0F50AB50-CF18-40B0-8F05-E49D73F3AE52", "vulnerable": true}, {"criteria": "cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_f:*:*:*:windows:*:*", "matchCriteriaId": "6308B84B-0AAC-454B-8998-0CA22CA33607", "vulnerable": true}, {"criteria": "cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_g:*:*:*:windows:*:*", "matchCriteriaId": "C177E75E-B015-49E4-916E-ACE011FF25C6", "vulnerable": true}, {"criteria": "cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_h:*:*:*:windows:*:*", "matchCriteriaId": "CDBE8B17-00A1-444A-8333-462618564FDE", "vulnerable": true}, {"criteria": "cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_i:*:*:*:windows:*:*", "matchCriteriaId": "AA60E827-8ACA-47A1-8446-53DCD5F902E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_j:*:*:*:windows:*:*", "matchCriteriaId": "1928F243-80CD-4B45-BB4B-D21AB17D624B", "vulnerable": true}, {"criteria": "cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_k:*:*:*:windows:*:*", "matchCriteriaId": "601DEE22-4EA9-4092-B636-67E37A7103B8", "vulnerable": true}, {"criteria": "cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_l:*:*:*:windows:*:*", "matchCriteriaId": "58C08E8E-453A-489A-A257-B2D61AA2E3A1", "vulnerable": true}, {"criteria": "cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_m:*:*:*:windows:*:*", "matchCriteriaId": "7E90CE59-9C17-4AE8-BD4B-6C7EAAE2F237", "vulnerable": true}, {"criteria": "cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_n:*:*:*:windows:*:*", "matchCriteriaId": "32AD7B8C-8033-4F07-84A8-3799506D75BA", "vulnerable": true}, {"criteria": "cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_o:*:*:*:windows:*:*", "matchCriteriaId": "3EF0EE02-EA49-4EBE-8407-1AF52B3E47AC", "vulnerable": true}, {"criteria": "cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_p:*:*:*:windows:*:*", "matchCriteriaId": "0CB5CA27-CADE-4081-9D78-F7EE5E5AE57F", "vulnerable": true}, {"criteria": "cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_q:*:*:*:windows:*:*", "matchCriteriaId": "FF4C06B6-3418-421B-8D30-20332C44E7D7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High."}, {"lang": "es", "value": "Un componente de Kaspersky Password Manager podr\u00eda permitir a un atacante elevar el nivel de integridad de un proceso de Medio a Alto"}], "id": "CVE-2021-35052", "lastModified": "2024-11-21T06:11:45.240", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-11-23T16:15:08.753", "references": [{"source": "vulnerability@kaspersky.com", "tags": ["Vendor Advisory"], "url": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#221121"}, {"source": "vulnerability@kaspersky.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1335/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#221121"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1335/"}], "sourceIdentifier": "vulnerability@kaspersky.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:kaspersky:password_manager:*:*:*:*:*:windows:*:* (string)

matchCriteriaId : A0AC120D-32C3-4E83-BB9D-4C69C18E1368 (string)

versionEndIncluding : 9.0.1 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:kaspersky:password_manager:9.0.2:-:*:*:*:windows:*:* (string)

matchCriteriaId : 058CA841-D966-46FD-81BB-17D931E24420 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_a:*:*:*:windows:*:* (string)

matchCriteriaId : 32B9179B-8F61-40AB-9926-3947AAE46A0D (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_b:*:*:*:windows:*:* (string)

matchCriteriaId : 558298F8-F5E4-4B77-90BB-A51B12863E69 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_c:*:*:*:windows:*:* (string)

matchCriteriaId : 61D1CE9D-159A-496D-AEB9-2C454C4B2986 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_d:*:*:*:windows:*:* (string)

matchCriteriaId : DD963F57-EF5F-436C-A696-83B98F03AA76 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_e:*:*:*:windows:*:* (string)

matchCriteriaId : 0F50AB50-CF18-40B0-8F05-E49D73F3AE52 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_f:*:*:*:windows:*:* (string)

matchCriteriaId : 6308B84B-0AAC-454B-8998-0CA22CA33607 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_g:*:*:*:windows:*:* (string)

matchCriteriaId : C177E75E-B015-49E4-916E-ACE011FF25C6 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_h:*:*:*:windows:*:* (string)

matchCriteriaId : CDBE8B17-00A1-444A-8333-462618564FDE (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_i:*:*:*:windows:*:* (string)

matchCriteriaId : AA60E827-8ACA-47A1-8446-53DCD5F902E6 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_j:*:*:*:windows:*:* (string)

matchCriteriaId : 1928F243-80CD-4B45-BB4B-D21AB17D624B (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_k:*:*:*:windows:*:* (string)

matchCriteriaId : 601DEE22-4EA9-4092-B636-67E37A7103B8 (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_l:*:*:*:windows:*:* (string)

matchCriteriaId : 58C08E8E-453A-489A-A257-B2D61AA2E3A1 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_m:*:*:*:windows:*:* (string)

matchCriteriaId : 7E90CE59-9C17-4AE8-BD4B-6C7EAAE2F237 (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_n:*:*:*:windows:*:* (string)

matchCriteriaId : 32AD7B8C-8033-4F07-84A8-3799506D75BA (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_o:*:*:*:windows:*:* (string)

matchCriteriaId : 3EF0EE02-EA49-4EBE-8407-1AF52B3E47AC (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_p:*:*:*:windows:*:* (string)

matchCriteriaId : 0CB5CA27-CADE-4081-9D78-F7EE5E5AE57F (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:kaspersky:password_manager:9.0.2:patch_q:*:*:*:windows:*:* (string)

matchCriteriaId : FF4C06B6-3418-421B-8D30-20332C44E7D7 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High. (string)

}

1 : { »

lang : es (string)

value : Un componente de Kaspersky Password Manager podría permitir a un atacante elevar el nivel de integridad de un proceso de Medio a Alto (string)

}

]

id : CVE-2021-35052 (string)

lastModified : 2024-11-21T06:11:45.240 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : LOCAL (string)

authentication : NONE (string)

availabilityImpact : PARTIAL (string)

baseScore : 4.6 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : PARTIAL (string)

vectorString : AV:L/AC:L/Au:N/C:P/I:P/A:P (string)

version : 2.0 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 6.4 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : HIGH (string)

baseScore : 7.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2021-11-23T16:15:08.753 (string)

references : [ »

0 : { »

source : vulnerability@kaspersky.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://support.kaspersky.com/general/vulnerability.aspx?el=12430#221121 (string)

}

1 : { »

source : vulnerability@kaspersky.com (string)

tags : [ »

0 : Third Party Advisory (string)

1 : VDB Entry (string)

]

url : https://www.zerodayinitiative.com/advisories/ZDI-21-1335/ (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://support.kaspersky.com/general/vulnerability.aspx?el=12430#221121 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

1 : VDB Entry (string)

]

url : https://www.zerodayinitiative.com/advisories/ZDI-21-1335/ (string)

}

]

sourceIdentifier : vulnerability@kaspersky.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-269 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object