PT-2024-19875 · Microsoft · Windows Network Drive Connector

Published 2024-02-06 · Updated 2024-02-14 · CVE-2024-23447

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Windows Network Drive Connector (affected versions not specified)

Description An issue was discovered in the Windows Network Drive Connector when using Document Level Security to assign permissions to a file, with explicit allow write and deny read. Although the document is not accessible to the user in Network Drive, it is visible in search applications to the user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-23447

Affected Products

Windows Network Drive Connector

References · 7

• https://osv.dev/vulnerability/CVE-2024-23447 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23447 · Security Note
• https://discuss.elastic.co/t/elastic-network-drive-connector-8-12-1-security-update-esa-2024-02/352687 · Vendor Advisory
• https://elastic.co/community/security · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1755124494144876619 · Twitter Post
• https://twitter.com/CVEnew/status/1755077035574313056 · Twitter Post
• https://t.me/cvenotify/70353 · Telegram Post