PT-2023-15388 · Rsa · Rsa Netwitness Platform

Hyp3Rlinx · Publicado 2023-03-24 · Atualizado 2024-04-11 · CVE-2022-47529

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Média

Vetor base

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RSA NetWitness Platform versions prior to 12.2

Description The issue allows local and admin Windows user accounts to modify the endpoint agent service configuration, either disabling it completely or running user-supplied code or commands. This bypasses tamper-protection features via ACL modification.

Recommendations For versions prior to 12.2, update to version 12.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the endpoint agent service configuration to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2022-47529

Produtos afetados

Rsa Netwitness Platform

Referências · 15

• 🔥 https://github.com/hyp3rlinx/CVE-2022-47529 · Exploit
• 🔥 https://exploit-db.com/exploits/51336 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2023/Mar/26 · Exploit
• 🔥 https://hyp3rlinx.altervista.org/advisories/RSA_NETWITNESS_EDR_AGENT_INCORRECT_ACCESS_CONTROL_CVE-2022-47529.txt · Exploit
• 🔥 https://packetstormsecurity.com/files/171476/RSA-NetWitness-Endpoint-EDR-Agent-12.x-Incorrect-Access-Control-Code-Execution.html · Exploit
• http://seclists.org/fulldisclosure/2024/Apr/17 · Nota
• https://t.me/cibsecurity/60890 · Publicação no Telegram
• https://t.me/cvenotify/46988 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-47529 · Nota de Segurança
• https://seclists.org/fulldisclosure/2023/Mar/16 · Nota
• https://t.me/cvenotify/76393 · Publicação no Telegram
• https://twitter.com/hyp3rlinx/status/1639335477839790105 · Nota
• https://community.netwitness.com/t5/netwitness-platform-security/nw-2023-04-netwitness-platform-security-advisory-cve-2022-47529/ta-p/696935 · Nota
• https://osv.dev/vulnerability/CVE-2022-47529 · Aviso do Fabricante
• https://t.me/defcon_news/111392 · Publicação no Telegram