cve/2020/CVE-2020-10139.md

### [CVE-2020-10139](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10139)
![](https://img.shields.io/static/v1?label=Product&message=True%20Image%202021&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%2032010%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-284%20Improper%20Access%20Control&color=brighgreen)

### Description

Acronis True Image 2021 includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\. Acronis True Image contains a privileged service that uses this OpenSSL component. Because unprivileged Windows users can create subdirectories off of the system root, a user can create the appropriate path to a specially-crafted openssl.cnf file to achieve arbitrary code execution with SYSTEM privileges.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/chnzzh/OpenSSL-CVE-lib