Lucene search

K
cve[email protected]CVE-2023-4996
HistoryNov 06, 2023 - 11:15 a.m.

CVE-2023-4996

2023-11-0611:15:09
CWE-281
web.nvd.nist.gov
26
netskope
nsclient
security vulnerability
cve-2023-4996
nvd
windows
servicecontroller
permissions

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.3%

Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious non-admin user can disable the Netskope client by using a specially-crafted package. The root cause of the problem was a user control code when called by a Windows ServiceController did not validate the permissions associated with the user before executing the user control code. This user control code had permissions to terminate the NSClient service.

Affected configurations

NVD
Node
microsoftwindowsMatch-
AND
netskopenetskopeRange<101
CPENameOperatorVersion
netskope:netskopenetskopelt101

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows"
    ],
    "product": "Netskope Client",
    "vendor": "Netskope",
    "versions": [
      {
        "status": "affected",
        "version": "100 & prior"
      }
    ]
  }
]

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.3%

Related for CVE-2023-4996