Lucene search

QualysCVE-2023-28140

HistoryApr 18, 2023 - 4:15 p.m.

CVE-2023-28140

2023-04-1816:15:09

CWE-427

Qualys

web.nvd.nist.gov

cve-2023-28140

executable hijacking

qualys cloud agent

windows

vulnerability

dll

local attack

privileges

nvd

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

An Executable Hijacking condition exists in the
Qualys Cloud Agent for Windows platform in versions before 4.5.3.1. Attackers
may load a malicious copy of a Dependency Link Library (DLL) via a local
attack vector instead of the DLL that the application was expecting, when
processes are running with escalated privileges. This vulnerability
is bounded only to the time of uninstallation and can only be exploited
locally.

At the time of this disclosure, versions before 4.0 are classified as End of
Life.

Affected configurations

Nvd

Node

qualyscloud_agentRange3.1.3.34–4.5.3.1windows

VendorProductVersionCPE
qualyscloud_agent*cpe:2.3:a:qualys:cloud_agent:*:*:*:*:*:windows:*:*

Vendor	Product	Version	CPE
qualys	cloud_agent	*	cpe:2.3:a:qualys:cloud_agent::::::windows::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows"
    ],
    "product": "Cloud Agent",
    "vendor": "Qualys",
    "versions": [
      {
        "lessThan": "4.5.3.1",
        "status": "affected",
        "version": "3.1.3.34",
        "versionType": "custom"
      }
    ]
  }
]

References

www.qualys.com/security-advisories/

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Related for CVE-2023-28140