PT-2024-29123 · Unknown · Absolute Secure Access

Published 2024-07-25 · Updated 2024-07-26 · CVE-2024-40872

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Absolute Secure Access versions prior to 13.07

Description The issue is related to an elevation of privilege vulnerability in server and client components. Attackers with local access and valid desktop user credentials can elevate their privilege to system level by passing invalid address data to the vulnerable component. This could be used to manipulate process tokens to elevate the privilege of a normal process to System. The impact to system confidentiality and integrity is high, while the impact to the availability of the affected component is none.

Recommendations For versions prior to 13.07, update to version 13.07 or later to resolve the issue. As a temporary workaround, consider restricting local access and validating user credentials to minimize the risk of exploitation. Additionally, restrict the use of the vulnerable component until a patch is available.

Fix

Untrusted Pointer Dereference

Weakness Enumeration

CWE-822

Related Identifiers

CVE-2024-40872

Affected Products

Absolute Secure Access

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-40872 · Security Note
• https://t.me/cvedetector/1636 · Telegram Post
• https://absolute.com/platform/security-information/vulnerability-archive/secure-access-1307/cve-2024-40872 · Note
• https://t.me/cvenotify/87536 · Telegram Post