PT-2024-15524 · Openssl+1 · Openssl+1

Will Dormann · Published 2024-04-03 · Updated 2024-04-03 · CVE-2024-0394

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rapid7 Minerva Armor versions prior to 4.5.5

Description The issue is a privilege escalation vulnerability that allows an authenticated attacker to elevate privileges and execute arbitrary code with SYSTEM privilege. This is caused by the product's implementation of OpenSSL's OPENSSLDIR parameter, which is set to a path accessible to low-privileged users.

Recommendations For versions prior to 4.5.5, update to version 4.5.5 to resolve the issue. As a temporary workaround, consider restricting access to the OPENSSLDIR path to prevent low-privileged users from exploiting the vulnerability.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-0394

Affected Products

Openssl

Rapid7 Minerva Armor

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-0394 · Security Note
• https://twitter.com/CVEnew/status/1775517974553661461 · Twitter Post
• https://twitter.com/f1tym1/status/1775534912113700944 · Twitter Post
• https://rapid7.com/blog/post/2024/04/03/cve-2024-0394-rapid7-minerva-armor-privilege-escalation-fixed · Note