Vulnerability · Published Jan 31, 2024 · Assigned by ProgressSoftware

CVE-2024-0833Privilege Elevation via Telerik Test Studio

High 7.8

In plain English

A high-severity privilege mismanagement in Telerik Test Studio from Progress Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 95.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In Telerik Test Studio versions prior to v2023.3.1330, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik Test Studio install is present, a lower privileged user has the ability to manipulate the installation package to elevate their privileges on the underlying operating system.

Affected products (as reported)

Vendor	Product	Versions
Progress Software	Telerik Test Studio	2011.0 – before v2023.3.1330

Weakness: CWE-269, CWE-276 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://www.telerik.com/teststudio product
https://docs.telerik.com/teststudio/knowledge-base/product-notices-kb/legacy-installer-vulnerability vendor-advisory