PT-2022-14053 · Okta · Okta Active Directory Agent

Published 2022-09-06 · Updated 2022-09-16 · CVE-2022-1697

Positive Technologies (AI Summary)

CVSS v3.1

3.9

Low

Base vector

AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Okta Active Directory Agent versions 3.8.0 through 3.11.0

Description The issue arises from the Okta Active Directory Agent installing the Okta AD Agent Update Service using an unquoted path, which can lead to privilege escalation.

Recommendations For Okta Active Directory Agent versions 3.8.0 through 3.11.0, uninstall the current version and reinstall Okta Active Directory Agent 3.12.0 or greater, following the provided documentation.

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2022-1697

Affected Products

Okta Active Directory Agent

References · 7

• https://help.okta.com/en-us/Content/Topics/Directory/ad-agent-update.htm · Vendor Advisory
• https://trust.okta.com/security-advisories/okta-active-directory-agent-cve-2022-1697 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-1697 · Vendor Advisory
• https://support.okta.com/help/s/article/Security-Notice-CVE-2022-1697-FAQ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1697 · Security Note
• https://t.me/cvenotify/36064 · Telegram Post
• https://t.me/cibsecurity/49336 · Telegram Post