CVE-2023-35799

Stormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions. An interactive user can use the SES Evolution agent to create arbitrary files with local system privileges.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://advisories.stormshield.eu	Vendor Advisory
https://advisories.stormshield.eu/2023-022/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:stormshield:endpoint_security:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-06-27 17:15

Updated : 2023-07-05 13:42

NVD link : CVE-2023-35799

Mitre link : CVE-2023-35799

CVE.ORG link : CVE-2023-35799

JSON object : View

Products Affected

stormshield

endpoint_security

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2023-35799", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2023-06-27T17:15:10.110", "references": [{"url": "https://advisories.stormshield.eu", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://advisories.stormshield.eu/2023-022/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "Stormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions. An interactive user can use the SES Evolution agent to create arbitrary files with local system privileges."}], "lastModified": "2023-07-05T13:42:25.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:stormshield:endpoint_security:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BAD1675D-5BA6-41EA-80B5-6EE0C638641D", "versionEndIncluding": "2.3.2", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

5.5 /10