GHSA-wvpv-ffcv-r6cw

    Dashboard / Vulnerabilities / GHSA-wvpv-ffcv-r6cw

    GHSA-wvpv-ffcv-r6cw

    Published: 14 Apr 2020Last Modified: 10 Sept 2026

    Summary: Internal NCryptDecrypt method could be used externally from WindowsHello library.

    Details: ### Impact Every user of the library before version 1.0.4. ### Patches Patched in 1.0.4+. ### Workarounds None. ### References https://github.com/SeppPenner/WindowsHello/issues/3 ### For more information It this library is used to encrypt text and write the output to a txt file, another executable could be able to decrypt the text using the static method NCryptDecrypt from this same library without the need to use Windows Hello Authentication again.

    References: https://github.com/SeppPenner/WindowsHello/security/advisories/GHSA-wvpv-ffcv-r6cw, https://nvd.nist.gov/vuln/detail/CVE-2020-11005, https://github.com/SeppPenner/WindowsHello/issues/3

    Affected packages

    Package

    Name: HaemmerElectronics.SeppPenner.WindowsHello

    Purl: pkg:nuget/HaemmerElectronics.SeppPenner.WindowsHello

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.0.4

    Affected versions

    1.0.0
    1.0.0.1
    1.0.2
    1.0.3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-wvpv-ffcv-r6cw | CVE-DB