PatchTheCVElocal run manager vulnerabilities and fixes
Recent CVEs affecting local run manager, with upgrade or downgrade steps. 5 tracked.
Also searched as: localrunmanager.
local run manager has 5 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 5. Most recent: 2022-06-24. Highest priority: CVE-2022-1517 (score 60/100).
- CVE-2022-1524 HIGH 7.4 UPGRADE LRM version 2.4 and lower does not implement TLS encryption
- CVE-2022-1521 CRITICAL 9.1 UPGRADE LRM does not implement authentication or authorization by default
- CVE-2022-1519 CRITICAL 10.0 UPGRADE LRM does not restrict the types of files that can be uploaded to the affected product
- CVE-2022-1518 CRITICAL 10.0 UPGRADE LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intend
- CVE-2022-1517 CRITICAL 10.0 UPGRADE LRM utilizes elevated privileges
FAQ
How do I fix local run manager vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is local run manager being exploited right now?
None of the tracked local run manager CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which local run manager CVE should I patch first?
CVE-2022-1517 currently ranks highest (60/100): LRM utilizes elevated privileges.