title:  One Identity Password Manager version 5.9.7.1 - Unauthenticated physical access privilege escalation
description:
One Identity Password Manager version 5.9.7.1 - An unauthenticated attacker with physical access to a workstation may upgrade privileges to SYSTEM through an unspecified method. CWE-250: Execution with Unnecessary Privileges.
problem types: CWE-250 -Execution with Unnecessary Privileges.
affected:
{
defaultStatus: unaffected
product:  One
vendor:  One
versions:
lessThanOrEqual: upgrade to versions 5.12.2, 5.11.2 or 5.13, status: affected, version: version 5.9.7.1, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
upgrade to versions 5.12.2, 5.11.2 or 5.13