There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This might allow a local user to escalate privileges by creating a "C:\Program Files\Sherpa Software\Sherpa.exe" file.
Loading...
Loading...
Score 7.8 from GitHub Security Advisory (severity: HIGH) published 2022-04-06. NVD baseline CVSS 7.8; sources differ by 0.0.
There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This might allow a local user to escalate privileges by creating a "C:\Program Files\Sherpa Software\Sherpa.exe" file.
April 5, 2022
November 21, 2024
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Every time one of our enrichment pipelines (NVD, MITRE cvelistV5, EPSS, CISA KEV, GHSA, OSV, vendor advisories) ran against this CVE. Most recent first.
Working exploit code is in the public domain (1 GitHub PoC) (1 Exploit-DB entry). Defenders should treat patch urgency accordingly — public PoCs typically lead to mass-exploitation within 24-72 hours.
Sherpa Connector Service v2020.2.20328.2050 - Unquoted Service Path
Open source ↗Unquoted Service Path privilege escalation vulnerability in Sherpa Connector Service.
Open source ↗See which npm, PyPI, Go, and Maven packages are affected by CVE-2022-23909
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.