PT-2017-17561 · Net Monitor · Net Monitor For Employees Pro

Saeid Atabaki · Publicado 2017-06-08 · Atualizado 2021-05-25 · CVE-2017-7180

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Net Monitor for Employees Pro versions 5.3.4 and earlier

Description The issue allows a Security Feature Bypass of the "Block applications" design goal. A local attacker with privileges to write to program.exe in a protected directory, such as the %SYSTEMDRIVE% directory, can exploit this. The goal of the attacker might be to execute program.exe even though it is a blocked application.

Recommendations For Net Monitor for Employees Pro versions 5.3.4 and earlier, consider restricting write access to the program.exe file in protected directories to minimize the risk of exploitation. As a temporary workaround, consider implementing additional access controls to prevent the execution of blocked applications until a fix is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-428

Identificadores relacionados

CVE-2017-7180

Produtos afetados

Net Monitor For Employees Pro

Referências · 3

• 🔥 https://exploit-db.com/exploits/42141 · Exploit
• https://osv.dev/vulnerability/CVE-2017-7180 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-7180 · Nota de Segurança