{"api_version":"1","generated_at":"2026-07-23T12:33:29+00:00","cve":"CVE-2020-8895","urls":{"html":"https://cve.report/CVE-2020-8895","api":"https://cve.report/api/cve/CVE-2020-8895.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-8895","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-8895"},"summary":{"title":"CVE-2020-8895","description":"Untrusted Search Path vulnerability in the windows installer of Google Earth Pro versions prior to 7.3.3 allows an attacker to insert malicious local files to execute unauthenticated remote code on the targeted system.","state":"PUBLIC","assigner":"security@google.com","published_at":"2020-04-21 18:15:00","updated_at":"2022-10-07 00:02:00"},"problem_types":["CWE-426"],"metrics":[],"references":[{"url":"https://support.google.com/earth/answer/40901?hl=en","name":"https://support.google.com/earth/answer/40901?hl=en","refsource":"MISC","tags":["Vendor Advisory"],"title":"See notes on Google Earth releases - Google Earth Help","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8895","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8895","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"LEGACY","value":"Daniel Díez Tainta","lang":""}],"nvd_cpes":[{"cve_year":"2020","cve_id":"8895","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"google","cpe5":"earth","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"pro","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"8895","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"google","cpe5":"earth","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"pro","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security@google.com","ID":"CVE-2020-8895","STATE":"PUBLIC","TITLE":"DLL Hijacking in Google Earth Pro Windows installer"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Earth Pro","version":{"version_data":[{"platform":"Windows","version_affected":"<","version_value":"7.3.3"}]}}]},"vendor_name":"Google"}]}},"credit":[{"lang":"eng","value":"Daniel Díez Tainta"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Untrusted Search Path vulnerability in the windows installer of Google Earth Pro versions prior to 7.3.3 allows an attacker to insert malicious local files to execute unauthenticated remote code on the targeted system."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":[{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-427 Uncontrolled Search Path Element"}]},{"description":[{"lang":"eng","value":"DLL Hijacking"}]}]},"references":{"reference_data":[{"name":"https://support.google.com/earth/answer/40901?hl=en","url":"https://support.google.com/earth/answer/40901?hl=en","refsource":"MISC"}]},"solution":[{"lang":"eng","value":"Recommended to update to Google Earth Pro 7.3.3 at your earliest convenience."}],"source":{"discovery":"EXTERNAL"}},"nvd":{"publishedDate":"2020-04-21 18:15:00","lastModifiedDate":"2022-10-07 00:02:00","problem_types":["CWE-426"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:L/AC:M/Au:N/C:P/I:P/A:P","accessVector":"LOCAL","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":4.4},"severity":"MEDIUM","exploitabilityScore":3.4,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:google:earth:*:*:*:*:pro:*:*:*","versionEndExcluding":"7.3.3","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"8895","Ordinal":"169248","Title":"CVE-2020-8895","CVE":"CVE-2020-8895","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"8895","Ordinal":"1","NoteData":"Untrusted Search Path vulnerability in the windows installer of Google Earth Pro versions prior to 7.3.3 allows an attacker to insert malicious local files to execute unauthenticated remote code on the targeted system.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"8895","Ordinal":"2","NoteData":"2020-04-21","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"8895","Ordinal":"3","NoteData":"2020-05-04","Type":"Other","Title":"Modified"}]}}}