PT-2024-26004 · Unknown · Kioware For Windows

Published 2024-05-09 · Updated 2025-02-12 · CVE-2024-3459

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions KioWare for Windows versions all through 8.35

Description The issue allows an attacker to escape the environment by downloading PDF files, which are then opened in an external PDF viewer. This can lead to launching a web browser, searching through local files, and subsequently launching any program with user privileges. Additionally, it is possible to brute force the PIN number that protects the application from being closed, as there are no mechanisms preventing excessive guessing of the number.

Recommendations For versions all through 8.35, consider disabling the feature that allows downloading and opening PDF files in an external viewer until a patch is available. As a temporary workaround, restrict access to the PIN number input field to prevent brute force attempts. Avoid using the default PDF viewer to open downloaded files in the affected KioWare for Windows versions until the issue is resolved.

Fix

Weakness Enumeration

CWE-424

Related Identifiers

CVE-2024-3459

Affected Products

Kioware For Windows

References · 7

• https://osv.dev/vulnerability/CVE-2024-3459 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3459 · Security Note
• https://t.me/cvenotify/110977 · Telegram Post
• https://cert.pl/en/posts/2024/04/CVE-2024-3459 · Note
• https://cert.pl/posts/2024/04/CVE-2024-3459 · Note
• https://kioware.com · Note
• https://t.me/cvenotify/111065 · Telegram Post