Threats tagged 'ghsa-q63q-8h8v-j42v'

Progressive Robot hMailServer 6.3.7's Windows installer has a vulnerability involving incorrect default permissions during installation in certain folder locations. When installed into a new program folder with permissive parent folder permissions (e.g., root of a drive), a local authenticated user can exploit a timing window before the installer hardens folder permissions. This allows the user to place malicious files in the Bin folder, which the installer then executes with administrator privileges, enabling code execution as the installing administrator. Installations under Program Files are not affected due to stricter default permissions.