Lucene search
DIVDCVELIST:CVE-2022-25153HistoryJun 08, 2022 - 12:00 a.m.
CVE-2022-25153 ITarian - Local privilege escalation in Endpoint Manager agent on Windows
2022-06-0800:00:00
CWE-275
DIVD
www.cve.org
4
cve-2022-25153
itarian
endpoint manager
local privilege escalation
windows
openssl
CVSS3
7.8
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0
Percentile
12.6%
The ITarian Endpoint Manage Communication Client, prior to version 6.43.41148.21120, is compiled using insecure OpenSSL settings. Due to this setting, a malicious actor with low privileges access to a system can escalate his privileges to SYSTEM abusing an insecure openssl.conf lookup.
CNA Affected
[
{
"product": "Endpoint Manager Communication Client for Windows",
"vendor": "ITarian",
"versions": [
{
"lessThan": "6.43.41148.21120",
"status": "affected",
"version": "any version",
"versionType": "custom"
}
]
}
]Related
nvd
nvd
CVE-2022-25153
2022-06-09 17:15:08
prion
prion
Design/Logic Flaw
2022-06-09 17:15:00
cve
cve
CVE-2022-25153
2022-06-09 17:15:08
malwarebytes
malwarebytes
CVSS3
7.8
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0
Percentile
12.6%
Related for CVELIST:CVE-2022-25153