Local Privilege Escalation Vulnerability in Phish Alert Button for Outlook

CVE-2024-29210

What is CVE-2024-29210?

A significant vulnerability in KnowBe4's Phish Alert Button for Outlook permits local privilege escalation due to improper permission settings on the application's configuration file. This vulnerability enables regular users to manipulate the file, which governs critical parameters like the update server URL, resulting in potential redirection to malicious servers. Such an action, when combined with other vulnerabilities, can allow an attacker to execute arbitrary code with elevated privileges. The ramifications are severe, including unauthorized access to sensitive information and possible takeover of the affected system. Mitigations include applying recent patches from KnowBe4 and reconfiguring permission settings to restrict access appropriately.

References