{"containers": {"cna": {"affected": [{"platforms": ["Windows"], "product": "Earth Pro", "vendor": "Google", "versions": [{"lessThan": "7.3.3", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Daniel D\u00edez Tainta"}], "descriptions": [{"lang": "en", "value": "Untrusted Search Path vulnerability in the windows installer of Google Earth Pro versions prior to 7.3.3 allows an attacker to insert malicious local files to execute unauthenticated remote code on the targeted system."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"description": "DLL Hijacking", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-05-04T20:07:40", "orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://support.google.com/earth/answer/40901?hl=en"}], "solutions": [{"lang": "en", "value": "Recommended to update to Google Earth Pro 7.3.3 at your earliest convenience."}], "source": {"discovery": "EXTERNAL"}, "title": "DLL Hijacking in Google Earth Pro Windows installer", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@google.com", "ID": "CVE-2020-8895", "STATE": "PUBLIC", "TITLE": "DLL Hijacking in Google Earth Pro Windows installer"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Earth Pro", "version": {"version_data": [{"platform": "Windows", "version_affected": "<", "version_value": "7.3.3"}]}}]}, "vendor_name": "Google"}]}}, "credit": [{"lang": "eng", "value": "Daniel D\u00edez Tainta"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Untrusted Search Path vulnerability in the windows installer of Google Earth Pro versions prior to 7.3.3 allows an attacker to insert malicious local files to execute unauthenticated remote code on the targeted system."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": [{"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-427 Uncontrolled Search Path Element"}]}, {"description": [{"lang": "eng", "value": "DLL Hijacking"}]}]}, "references": {"reference_data": [{"name": "https://support.google.com/earth/answer/40901?hl=en", "refsource": "MISC", "url": "https://support.google.com/earth/answer/40901?hl=en"}]}, "solution": [{"lang": "en", "value": "Recommended to update to Google Earth Pro 7.3.3 at your earliest convenience."}], "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T10:12:11.060Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.google.com/earth/answer/40901?hl=en"}]}]}, "cveMetadata": {"assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "assignerShortName": "Google", "cveId": "CVE-2020-8895", "datePublished": "2020-04-21T17:50:11", "dateReserved": "2020-02-12T00:00:00", "dateUpdated": "2024-08-04T10:12:11.060Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:earth:*:*:*:*:pro:*:*:*", "matchCriteriaId": "C4497E6A-C9B2-4FCB-8A43-6E3033BD9E0E", "versionEndExcluding": "7.3.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Untrusted Search Path vulnerability in the windows installer of Google Earth Pro versions prior to 7.3.3 allows an attacker to insert malicious local files to execute unauthenticated remote code on the targeted system."}, {"lang": "es", "value": "La vulnerabilidad de la ruta de b\u00fasqueda no segura en el instalador de Windows de las versiones de Google Earth Pro anteriores a la versi\u00f3n 7.3.3 permite a un atacante insertar archivos locales maliciosos para ejecutar c\u00f3digo remoto no identificado en el sistema de destino."}], "id": "CVE-2020-8895", "lastModified": "2024-11-21T05:39:39.017", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "cve-coordination@google.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-04-21T18:15:12.797", "references": [{"source": "cve-coordination@google.com", "tags": ["Vendor Advisory"], "url": "https://support.google.com/earth/answer/40901?hl=en"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.google.com/earth/answer/40901?hl=en"}], "sourceIdentifier": "cve-coordination@google.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "cve-coordination@google.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-426"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}