PT-2024-12920 · Atos · Atos Eviden Cardos Api

Published 2024-03-22 · Updated 2024-08-22 · CVE-2023-41099

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Atos Eviden CardOS API versions prior to 5.5.5.2811

Description The issue allows for Local Privilege Escalation, enabling an attacker to escalate privileges from a regular user to SYSTEM. This occurs in the Windows installer component of the affected software.

Recommendations For versions prior to 5.5.5.2811, update to version 5.5.5.2811 or later to resolve the issue.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2023-41099

Affected Products

Atos Eviden Cardos Api

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-41099 · Security Note
• https://support.bull.com/ols/product/security/psirt/security-bulletins/cardos-api-local-privilege-escalation-psirt-358-tlp-clear-version-2-6-cve-2023-41099/view · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-41099 · Vendor Advisory
• https://t.me/cvenotify/91767 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1771214403515338799 · Twitter Post
• https://twitter.com/CVEnew/status/1771182555171074267 · Twitter Post