{"cve":"CVE-2020-15264","nvd":{"published":"2020-10-20T21:15:12.633","modified":"2026-06-17T02:56:23.387","status":"Modified","description":"The Boxstarter installer before version 2.13.0 configures C:\\ProgramData\\Boxstarter to be in the system-wide PATH environment variable. However, this directory is writable by normal, unprivileged users. To exploit the vulnerability, place a DLL in this directory that a privileged service is looking for. For example, WptsExtensions.dll When Windows starts, it'll execute the code in DllMain() with SYSTEM privileges. Any unprivileged user can execute code with SYSTEM privileges. The issue is fixed in version 3.13.0","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-73","CWE-668"],"references":["https://github.com/chocolatey/boxstarter/commit/67e320491813550b48900e87105a34ceefdcf633","https://github.com/chocolatey/boxstarter/security/advisories/GHSA-rpgx-h675-r3jf","https://www.kb.cert.org/vuls/id/208577","https://github.com/chocolatey/boxstarter/commit/67e320491813550b48900e87105a34ceefdcf633","https://github.com/chocolatey/boxstarter/security/advisories/GHSA-rpgx-h675-r3jf"],"products":["chocolatey:boxstarter"],"source":"nvd","synced_at":"2026-10-19T21:09:53.489947993+00:00"},"epss":{"cve":"CVE-2020-15264","score":0.01551,"percentile":0.75106,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}