PT-2024-24121 · Microsoft+1 · Windows+2

Published 2024-04-04 · Updated 2024-08-27 · CVE-2024-31498

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yubico ykman-gui (aka YubiKey Manager GUI) versions prior to 1.2.6

Description A privilege escalation issue exists because browser windows can open as Administrator when Edge is not used on Windows systems. This could allow for unexpected privilege escalation. The issue arises because Windows requires administrative permissions to open certain browser windows.

Recommendations For versions prior to 1.2.6, update to version 1.2.6 or later to resolve the issue. As a temporary workaround, consider using Edge as the default browser to minimize the risk of exploitation. Restrict access to administrative privileges to prevent potential escalation of privileges attacks.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2024-31498

Affected Products

Edge

Windows

Yubico Ykman-Gui

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-31498 · Security Note
• https://t.me/ckure/13852 · Telegram Post
• https://twitter.com/Komodosec/status/1776324949441233181 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1776088687534895306 · Twitter Post
• https://twitter.com/Dinosn/status/1776099029887140176 · Twitter Post
• https://twitter.com/CVEnew/status/1776013897335554308 · Twitter Post
• https://twitter.com/fletch_ai/status/1776475122645483698 · Twitter Post
• https://twitter.com/RsSI47041968/status/1777374867370938391 · Twitter Post
• https://t.me/cvenotify/75986 · Telegram Post
• https://twitter.com/techprofits/status/1780599780579684446 · Twitter Post
• https://t.me/pentestingnews/45555 · Telegram Post
• https://yubico.com/support/security-advisories/ysa-2024-01 · Note