PT-2022-17730 · Microsoft · Windows

Published 2022-10-06 · Updated 2022-10-11 · CVE-2022-26235

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Remisol Advance versions 2.0.12.1 and below

Description A vulnerability was discovered in the Remisol Advance for the Normand Message Server, where the permissions set by Remisol Advance allow non-privileged users to overwrite and/or manipulate executables and libraries that run as the elevated SYSTEM user on Windows.

Recommendations For Remisol Advance versions 2.0.12.1 and below, consider restricting the permissions set by Remisol Advance to prevent non-privileged users from overwriting and/or manipulating executables and libraries that run as the elevated SYSTEM user on Windows. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2022-26235

Affected Products

Windows

References · 4

• https://beckmancoulter.com/products/clinical-information-management-tools/remisol-advance · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26235 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26235 · Security Note
• https://pastebin.com/amgw9pE7 · Note