{"api_version":"1","generated_at":"2026-07-24T18:46:35+00:00","cve":"CVE-2020-15264","urls":{"html":"https://cve.report/CVE-2020-15264","api":"https://cve.report/api/cve/CVE-2020-15264.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-15264","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-15264"},"summary":{"title":"CVE-2020-15264","description":"The Boxstarter installer before version 2.13.0 configures C:\\ProgramData\\Boxstarter to be in the system-wide PATH environment variable. However, this directory is writable by normal, unprivileged users. To exploit the vulnerability, place a DLL in this directory that a privileged service is looking for. For example, WptsExtensions.dll When Windows starts, it'll execute the code in DllMain() with SYSTEM privileges. Any unprivileged user can execute code with SYSTEM privileges. The issue is fixed in version 3.13.0","state":"PUBLIC","assigner":"security-advisories@github.com","published_at":"2020-10-20 21:15:00","updated_at":"2020-10-30 22:32:00"},"problem_types":["CWE-668","CWE-73"],"metrics":[],"references":[{"url":"https://github.com/chocolatey/boxstarter/commit/67e320491813550b48900e87105a34ceefdcf633","name":"https://github.com/chocolatey/boxstarter/commit/67e320491813550b48900e87105a34ceefdcf633","refsource":"MISC","tags":["Patch","Third Party Advisory"],"title":"Merge pull request from GHSA-rpgx-h675-r3jf · chocolatey/boxstarter@67e3204 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.kb.cert.org/vuls/id/208577","name":"VU#208577","refsource":"CERT-VN","tags":["Third Party Advisory"],"title":"VU#208577 - Chocolatey Boxstarter vulnerable to privilege escalation due to weak ACLs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/chocolatey/boxstarter/security/advisories/GHSA-rpgx-h675-r3jf","name":"https://github.com/chocolatey/boxstarter/security/advisories/GHSA-rpgx-h675-r3jf","refsource":"CONFIRM","tags":["Third Party Advisory"],"title":"Boxstarter folder allows write access for standard users · Advisory · chocolatey/boxstarter · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15264","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15264","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"15264","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"chocolatey","cpe5":"boxstarter","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"15264","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"chocolatey","cpe5":"boxstarter","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-advisories@github.com","ID":"CVE-2020-15264","STATE":"PUBLIC","TITLE":"Privilege Escalation in Boxstarter"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"boxstarter","version":{"version_data":[{"version_value":"< 2.13.0"}]}}]},"vendor_name":"chocolatey"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Boxstarter installer before version 2.13.0 configures C:\\ProgramData\\Boxstarter to be in the system-wide PATH environment variable. However, this directory is writable by normal, unprivileged users. To exploit the vulnerability, place a DLL in this directory that a privileged service is looking for. For example, WptsExtensions.dll When Windows starts, it'll execute the code in DllMain() with SYSTEM privileges. Any unprivileged user can execute code with SYSTEM privileges. The issue is fixed in version 3.13.0"}]},"impact":{"cvss":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-668 Exposure of Resource to Wrong Sphere"}]},{"description":[{"lang":"eng","value":"CWE-73 External Control of File Name or Path"}]}]},"references":{"reference_data":[{"name":"https://github.com/chocolatey/boxstarter/security/advisories/GHSA-rpgx-h675-r3jf","refsource":"CONFIRM","url":"https://github.com/chocolatey/boxstarter/security/advisories/GHSA-rpgx-h675-r3jf"},{"name":"https://github.com/chocolatey/boxstarter/commit/67e320491813550b48900e87105a34ceefdcf633","refsource":"MISC","url":"https://github.com/chocolatey/boxstarter/commit/67e320491813550b48900e87105a34ceefdcf633"},{"refsource":"CERT-VN","name":"VU#208577","url":"https://www.kb.cert.org/vuls/id/208577"}]},"source":{"advisory":"GHSA-rpgx-h675-r3jf","discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2020-10-20 21:15:00","lastModifiedDate":"2020-10-30 22:32:00","problem_types":["CWE-668","CWE-73"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:C/I:C/A:C","accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE","baseScore":7.2},"severity":"HIGH","exploitabilityScore":3.9,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:chocolatey:boxstarter:*:*:*:*:*:*:*:*","versionEndExcluding":"2.13.0","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"15264","Ordinal":"176643","Title":"CVE-2020-15264","CVE":"CVE-2020-15264","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"15264","Ordinal":"1","NoteData":"The Boxstarter installer before version 2.13.0 configures C:\\ProgramData\\Boxstarter to be in the system-wide PATH environment variable. However, this directory is writable by normal, unprivileged users. To exploit the vulnerability, place a DLL in this directory that a privileged service is looking for. For example, WptsExtensions.dll When Windows starts, it'll execute the code in DllMain() with SYSTEM privileges. Any unprivileged user can execute code with SYSTEM privileges. The issue is fixed in version 3.13.0","Type":"Description","Title":null},{"CveYear":"2020","CveId":"15264","Ordinal":"2","NoteData":"2020-10-20","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"15264","Ordinal":"3","NoteData":"2020-10-22","Type":"Other","Title":"Modified"}]}}}