PT-2024-8722 · Siport · Siport

Published 2024-11-12 · Updated 2024-11-17 · CVE-2024-47783

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SIPORT versions prior to V3.4.0

Description A vulnerability has been identified in the affected application, which improperly assigns file permissions to installation folders. This could allow a local attacker with an unprivileged account to override or modify the service executables and subsequently gain elevated privileges. The vulnerability is related to the improper assignment of permissions for critical resources, which can be exploited to elevate privileges.

Recommendations For versions prior to V3.4.0, update to version V3.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the installation folders to prevent modification of service executables. Additionally, monitor system activity for any suspicious changes to file permissions or service executables.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2024-10325

CVE-2024-47783

Affected Products

Siport

References · 8

• https://cert-portal.siemens.com/productcert/html/ssa-064257.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47783 · Security Note
• https://bdu.fstec.ru/vul/2024-10325 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47783 · Vendor Advisory
• https://twitter.com/CveFindCom/status/1856329235377385607 · Twitter Post
• https://twitter.com/cracbot/status/1858027362472046735 · Twitter Post
• https://t.me/cvedetector/10609 · Telegram Post
• https://twitter.com/CVEnew/status/1856321749211627718 · Twitter Post