Weakness (CWE)
CWE-428: Unquoted Search Path or Element
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
How to prevent it (3 mitigations)
-
Implementation
Properly quote the full search path before executing a program on the system.
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
-
Implementation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
Source: MITRE CWE-428
359 results · Feed
-
High 7.8
Unquoted item or search path vulnerability in Faronics Deep Freeze Server Standard
A search path or unquoted item vulnerability in Faronics Deep Freeze Server Standard, which affects versions 8.30.020.4627 and earlier. This vulnerability affects the DFServ.exe file. An attacker with local user privileges could exploit this vulnerability to …
-
High 7.8
Wiesemann & Theis: Multiple products prone to unquoted search path
A local attacker can gain administrative privileges by inserting an executable file in the path of the affected product.
-
Critical 9.1
An unquoted service path vulnerability in the 12d Synergy Server and File Replication Server components may allow an at…
-
Medium 6.7
Unquoted search path or element in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an…
-
High 7.8
PanteraSoft HDD Health search path or unquoted item vulnerability
Search path or unquoted item vulnerability in HDD Health affecting versions 4.2.0.112 and earlier. This vulnerability could allow a local attacker to store a malicious executable file within the unquoted search path, resulting in privilege escalation.
-
High 7.2
Automation Studio and PVI Multiple unquoted service path vulnerabilities
Unquoted Search Path or Element vulnerability in B&R Industrial Automation Automation Studio, B&R Industrial Automation NET/PVI allows Target Programs with Elevated Privileges.This issue affects Automation Studio: from 4.0 through 4.6, from 4.7.0 before 4.7.7…
-
Low 3.3
Unquoted path privilege vulnerability in ESET products for Windows
Unquoted service path in ESET products allows to drop a prepared program to a specific location and run on boot with the NT AUTHORITY\NetworkService permissions.
-
High 7.8
Subnet Solutions Inc. PowerSYSTEM Center Unquoted Search Path or Element
PowerSYSTEM Center versions 2020 Update 16 and prior contain a vulnerability that may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate privileges.
-
Medium 6.7
Unquoted search path in some Intel(R) NUC Kits NUC7i3DN, NUC7i5DN, NUC7i7DN HDMI firmware update tool software before v…
-
Medium 6.7
Unquoted search path in the installer for some Intel Server Configuration Utility software before version 16.0.9 may al…
-
Medium 6.7
Unquoted search path or element in some Intel(R) Arc(TM) Control software before version 1.73.5335.2 may allow an authe…
-
Low 3.9
The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execu…
-
Medium 6.3
Fortect - CWE-428: Unquoted Search Path or Element
Fortect - CWE-428: Unquoted Search Path or Element, may be used by local user to elevate privileges.
-
Medium 5.3
Topaz OFD Protection Module Warsaw core.exe unquoted search path
A vulnerability, which was classified as problematic, was found in Topaz OFD 2.11.0.201. This affects an unknown part of the file C:\Program Files\Topaz OFD\Warsaw\core.exe of the component Protection Module Warsaw. The manipulation leads to unquoted search p…
-
High 7.8
NextBX QWAlerter QWAlerter.exe unquoted search path
A vulnerability was found in NextBX QWAlerter 4.50. It has been rated as critical. Affected by this issue is some unknown functionality of the file QWAlerter.exe. The manipulation leads to unquoted search path. It is possible to launch the attack on the local…
-
Medium 6.7
Unquoted search path in the software installer for the System Firmware Update Utility (SysFwUpdt) for some Intel(R) Ser…
-
High 7.2
Unquoted Service Path in ABB AO-OPC
A vulnerability was found in AO-OPC server versions mentioned above. As the directory information for the service entry is not enclosed in quotation marks, potential attackers could possibly call up another application than the AO-OPC server by starting the s…
-
High 7.8
Pointware EasyInventory Easy2W.exe unquoted search path
A vulnerability was found in Pointware EasyInventory 1.0.12.0 and classified as critical. This issue affects some unknown processing of the file C:\Program Files (x86)\EasyInventory\Easy2W.exe. The manipulation leads to unquoted search path. Attacking locally…
-
Critical 9.8
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remo…
-
Medium 4.4
An unquoted Windows search path vulnerability existed in the install the MOVE 4.10.x and earlier Windows install servic…
-
Medium 6.7
Improper Quoting Path Issue in Bitdefender Total Security
Unquoted Search Path or Element vulnerability in the Vulnerability Scan component of Bitdefender Total Security, Bitdefender Internet Security, and Bitdefender Antivirus Plus allows an attacker to elevate privileges to SYSTEM. This issue affects: Bitdefender …
-
High 7.8CVE-2023-31747 Public exploit
Wondershare Filmora 12 (Build 12.2.1.2088) was discovered to contain an unquoted service path vulnerability via the com…
-
Medium 5.3
DigitalPersona FPSensor DpHost.exe unquoted search path
A vulnerability, which was classified as problematic, has been found in DigitalPersona FPSensor 1.0.0.1. This issue affects some unknown processing of the file C:\Program Files (x86)\FPSensor\bin\DpHost.exe. The manipulation leads to unquoted search path. Att…
-
Medium 5.3
ks-soft Advanced Host Monitor rma_active.exe unquoted search path
A vulnerability was found in ks-soft Advanced Host Monitor up to 12.56 and classified as problematic. Affected by this issue is some unknown functionality of the file C:\Program Files (x86)\HostMonitor\RMA-Win\rma_active.exe. The manipulation leads to unquote…
-
High 7.8
Bypassing hardening via Unquoted Service path vulnerability
Unquoted service Path or Element vulnerability in 42Gears Surelock Windows SureLock Service (NixService.Exe) on Windows application will allows to insert arbitrary code into the service. This issue affects Surelock Windows : from 2.3.12 through 2.40.0.
-
High 7.3
WAB-MAT Ver.5.0.0.8 and earlier starts another program with an unquoted file path. Since a registered Windows service p…
-
High 7.8
Dell Multifunction Printer E525w Driver and Software Suite, versions prior to 1.047.2022, A05, contain a local privileg…
-
High 7.0
phjounin TFTPD64-SE tftpd64_svc.exe unquoted search path
A vulnerability was found in phjounin TFTPD64-SE 4.64 and classified as critical. This issue affects some unknown processing of the file tftpd64_svc.exe. The manipulation leads to unquoted search path. An attack has to be approached locally. The complexity of…
-
High 7.8
Dentsply Sirona Sidexis <= 4.3 is vulnerable to Unquoted Service Path.
-
High 7.8
Hima: Unquoted path vulnerabilities in HIMA PC based Software
In multiple versions of HIMA PC based Software an unquoted Windows search path vulnerability might allow local users to gain privileges via a malicious .exe file and gain full access to the system.
-
Medium 5.3
Avira Security for Windows - Denial of Service
Avira Security for Windows contains an unquoted service path which allows attackers with local administrative privileges to cause a Denial of Service. The issue was fixed with Avira Security version 1.1.78
-
High 7.8
Realtek Audio Drivers for Windows, as used on the Lenovo ThinkPad X1 Carbon 20A7, 20A8, 20BS, and 20BT before 6.0.8882.…
-
Medium 6.7
Roxio Creator LJB starts another program with an unquoted file path. Since a registered Windows service path contains s…
-
High 7.8CVE-2022-37197 Public exploit
IOBit IOTransfer V4 is vulnerable to Unquoted Service Path.
-
Medium 6.7
Unquoted search path in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before…
-
High 7.8
Dell GeoDrive, versions prior to 2.2, contains an Unquoted File Path vulnerability. A low privilege attacker could pote…
-
Unscored —
In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed withi…
-
Medium 6.3
FileZilla Client Installer uninstall.exe unquoted search path
A vulnerability has been found in FileZilla Client 3.17.0.0 and classified as problematic. This vulnerability affects unknown code of the file C:\Program Files\FileZilla FTP Client\uninstall.exe of the component Installer. The manipulation leads to unquoted s…
-
Unscored —
SAP BusinessObjects BW Publisher Service - versions 420, 430, uses a search path that contains an unquoted element. A l…
-
Medium 6.5
Unquoted Service Path in Cloudflare WARP for Windows
Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation. The fix was released in version 2022.3.186.0.