Lucene search

TrellixVULNRICHMENT:CVE-2024-0311

HistoryMar 14, 2024 - 9:06 a.m.

CVE-2024-0311

2024-03-1409:06:25

CWE-622

trellix

github.com

malicious insider

existing policy

skyhigh client proxy

release code

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

A malicious insider can bypass the existing policy of Skyhigh Client Proxy without a valid release code.

CNA Affected

[
  {
    "vendor": "Skyhigh",
    "product": "Skyhigh Client Proxy",
    "versions": [
      {
        "status": "affected",
        "version": "4.8.1"
      }
    ],
    "platforms": [
      "Windows"
    ],
    "defaultStatus": "unaffected"
  }
]

References

kcm.trellix.com/corporate/index?page=content&id=SB10418

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-0311