CVE-2017-20018 XAMPP Installer uncontrolled search path

HighCVSS 7.8 EPSS 0.64%

Published: 2022-06-10 01:35
Updated: 2026-06-17 04:14
Exploit status: No public exploit known

Description

A vulnerability was found in XAMPP 7.1.1-0-VC14. It has been classified as problematic. Affected is an unknown function of the component Installer. The manipulation leads to privilege escalation. It is possible to launch the attack remotely.

Affected products

Product	Affected versions	Fixed in
apachefriends xampp	= 7.1.1-0-vc14	No fix listed

References

packetstormsecurity.com exploit mitigation third-party-advisory vdb-entry
vuldb.com third-party-advisory

CVSS v3.1

7.8 High

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector: Local
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

All scores (4)

v3.1 7.8 · nvd@nist.gov
v3.1 6.3 · vuldb
v3.1 6.3 · cna@vuldb.com
v2.0 4.4 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.64% (percentile 51.1)
CWE: CWE-427 Uncontrolled Search Path

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.