CVE-2020-10143

Macrium Reflect includes an OpenSSL component that specifies an OPENSSLDIR variable as C:\openssl\. Macrium Reflect contains a privileged service that uses this OpenSSL component. Because unprivileged Windows users can create subdirectories off of the system root, a user can create the appropriate path to a specially-crafted openssl.cnf file to achieve arbitrary code execution with SYSTEM privileges.

• CWE-284
• CWE-665

• https://www.kb.cert.org/vuls/id/760767Third Party Advisory, US Government Resource
• https://www.kb.cert.org/vuls/id/760767Third Party Advisory, US Government Resource

Published

Dec 9, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10136IP-in-IP protocol specifies IP Encapsulation within IP stand…5.3
• CVE-2020-10137Z-Wave devices based on Silicon Labs 700 series chipsets usi…6.5
• CVE-2020-10138Acronis Cyber Backup 12.5 and Cyber Protect 15 include an Op…7.8
• CVE-2020-10139Acronis True Image 2021 includes an OpenSSL component that s…7.8
• CVE-2020-1014An elevation of privilege vulnerability exists in the Micros…7.8
• CVE-2020-10140Acronis True Image 2021 fails to properly set ACLs of the C:…7.3
• CVE-2020-10145The Adobe ColdFusion installer fails to set a secure access-…7.8
• CVE-2020-10146The Microsoft Teams online service contains a stored cross-s…5.4
• CVE-2020-10148The SolarWinds Orion API is vulnerable to an authentication …9.8
• CVE-2020-1015An elevation of privilege vulnerability exists in the way th…7.8
• CVE-2020-1016An information disclosure vulnerability exists when the Wind…5.5
• CVE-2020-1017An elevation of privilege vulnerability exists in the way th…7.8