CVE-2021-41065

Name of the Vulnerable Software and Affected Versions Listary versions through 6

Description An issue was discovered that allows an attacker to create a named pipe and wait for a privileged user to open a session on the host where Listary is installed. Listary will automatically access the named pipe, enabling the attacker to duplicate the victim's token and impersonate them. This issue is valid in certain Windows versions, although Microsoft has patched it in later Windows 10 builds.

Recommendations For Listary versions through 6, consider disabling the named pipe functionality as a temporary workaround until a patch is available. Restrict access to the .pipeListary.listaryService named pipe to minimize the risk of exploitation.