PT-2023-25320 · Stormshield · Stormshield Endpoint Security Evolution

Published 2023-06-27 · Updated 2023-07-05 · CVE-2023-35799

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Stormshield Endpoint Security Evolution versions 2.0.0 through 2.3.2

Description The issue allows an interactive user to create arbitrary files with local system privileges using the SES Evolution agent due to insecure permissions.

Recommendations For versions 2.0.0 through 2.3.2, consider restricting the privileges of the SES Evolution agent to prevent the creation of arbitrary files with local system privileges until a fix is available.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2023-35799

Affected Products

Stormshield Endpoint Security Evolution

References · 7

• https://cve.org/CVERecord?id=CVE-2023-35799 · Security Note
• https://advisories.stormshield.eu/2023-022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35799 · Security Note
• https://osv.dev/vulnerability/CVE-2023-35799 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-35799 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-35799 · Vendor Advisory
• https://advisories.stormshield.eu · Vendor Advisory