Vulnerability · Published May 22, 2024 · Assigned by zdi

CVE-2024-4454WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability

High 7.3

In plain English

A high-severity security flaw in Elements from WithSecure. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.0)7.3High

Exploit odds (30 days)0.4%top 65.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of WithSecure Elements Endpoint Protection. User interaction on the part of an administrator is required to exploit this vulnerability. The specific flaw exists within the WithSecure plugin hosting service. By creating a symbolic link, an attacker can abuse the service to create a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23035.

Affected products (as reported)

Vendor	Product	Versions
WithSecure	Elements	23.9

Weakness: CWE-59 · Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

ZDI-24-491 x_research-advisory