CVE-2023-28140mediumCWE-427

CVE-2023-28140: falha de média gravidade em Qualys Cloud Agent

Executable Hijacking

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Cloud Agent

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.7epss 0.2%
An Executable Hijacking condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.5.3.1. Attackers may load a malicious copy of a Dependency Link Library (DLL) via a local attack vector instead of the DLL that the application was expecting, when processes are running with escalated privileges. This vulnerability is bounded only to the time of uninstallation and can only be exploited locally. At the time of this disclosure, versions before 4.0 are classified as End of Life.
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
Qualys · Cloud Agent
CVEs relacionadas — Qualys Cloud Agent

No mesmo produto, das mais perigosas para as menos.

CVE-2023-28141MEDIUMNTFS JunctionEPSS 0.2%CVE-2023-28143MEDIUMLocal Privilege EscalationEPSS 0.2%CVE-2023-28142MEDIUMRace ConditionEPSS 0.1%