Race condition in Photo Station - #VU47731
Published: October 20, 2020
Vulnerability identifier: #VU47731
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-362
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to a race condition in the "SYNOPHOTO_Flickr_MultiUpload" function. A remote authenticated attacker can exploit the race and execute arbitrary code with elevated privileges.
Affected software
Photo Station
Remediation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.