Vulnerability · Published Feb 16, 2024 · Assigned by BT
CVE-2024-1591Privilege Management for Windows < 24.1 Information Leak
Low 3.3
In plain English
A low-severity information exposure in Privilege Management for Windows from BeyondTrust. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).
Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 95.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Prior to version 24.1, a local authenticated attacker can view Sysvol when Privilege Management for Windows is configured to use a GPO policy. This allows them to view the policy and potentially find configuration issues.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| BeyondTrust | Privilege Management for Windows | 1 – before 24.1 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N