Uncontrolled Search Path Element Vulnerability in VIPRE Advanced Security by GFI Software
CVE-2024-5929

7.8HIGH

Key Information:

Vendor

Vipre

Status
Advanced Security
Vendor
CVE Published:
21 August 2024

What is CVE-2024-5929?

The vulnerability within VIPRE Advanced Security's Patch Management Agent arises from the loading of a file from an unsecured location. Local attackers who already possess low-privileged access can exploit this flaw to escalate their privileges and execute arbitrary code with SYSTEM-level permissions. This can lead to unauthorized actions within the system, posing significant risks to the integrity and confidentiality of sensitive data.

References

https://www.zerodayinitiative.com/advisories/ZDI-24-818/
https://success.vipre.com/en_US/home-windows-release-note...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.
CVE-2024-5929 : Uncontrolled Search Path Element Vulnerability in VIPRE Advanced Security by GFI Software