CVE-2023-6119

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.0 / Impact : 4.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

An Improper Privilege Management vulnerability in Trellix GetSusp prior to version 5.0.0.27 allows a local, low privilege attacker to gain access to files that usually require a higher privilege level. This is caused by GetSusp not correctly protecting a directory that it creates during execution, allowing an attacker to take over file handles used by GetSusp. As this runs with high privileges, the attacker gains elevated permissions. The file handles are opened as read-only.

References

Link	Resource
https://kcm.trellix.com/corporate/index?page=content&id=SB10412	Vendor Advisory
https://kcm.trellix.com/corporate/index?page=content&id=SB10412	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:trellix:getsusp:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:43

Type	Values Removed	Values Added
References	~~() https://kcm.trellix.com/corporate/index?page=content&id=SB10412 - Vendor Advisory~~	() https://kcm.trellix.com/corporate/index?page=content&id=SB10412 - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~7.8~~	v2 : unknown v3 : 6.5

Information

Published : 2023-11-16 10:15

Updated : 2024-11-21 08:43

NVD link : CVE-2023-6119

Mitre link : CVE-2023-6119

CVE.ORG link : CVE-2023-6119

JSON object : View

Products Affected

getsusp

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2023-6119", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.0}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2023-11-16T10:15:19.217", "references": [{"url": "https://kcm.trellix.com/corporate/index?page=content&id=SB10412", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://kcm.trellix.com/corporate/index?page=content&id=SB10412", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-269"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "\nAn Improper Privilege Management vulnerability in Trellix GetSusp prior to version 5.0.0.27 allows a local, low privilege attacker to gain access to files that usually require a higher privilege level. This is caused by GetSusp not correctly protecting a directory that it creates during execution, allowing an attacker to take over file handles used by GetSusp. As this runs with high privileges, the attacker gains elevated permissions. The file handles are opened as read-only. \n\n"}, {"lang": "es", "value": "Una vulnerabilidad de Gesti\u00f3n de Privilegios Inadecuada en Trellix GetSusp anterior a la versi\u00f3n 5.0.0.27 permite a un atacante local con pocos privilegios obtener acceso a archivos que normalmente requieren un nivel de privilegio m\u00e1s alto. Esto se debe a que GetSusp no protege correctamente un directorio que crea durante la ejecuci\u00f3n, lo que permite a un atacante hacerse cargo de los identificadores de archivos utilizados por GetSusp. Como esto se ejecuta con altos privilegios, el atacante obtiene permisos elevados. Los identificadores de archivos se abren como de solo lectura."}], "lastModified": "2024-11-21T08:43:10.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:trellix:getsusp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AAF002A6-9A8D-4396-98C8-105E59077E70", "versionEndExcluding": "5.0.0.27"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}