Executive Summary

Informations
Name CVE-2023-28140 First vendor Publication 2023-04-18
Vendor Cve Last vendor Modification 2023-04-28

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Overall CVSS Score 7
Base Score 7 Environmental Score 7
impact SubScore 5.9 Temporal Score 7
Exploitabality Sub Score 1
 
Attack Vector Local Attack Complexity High
Privileges Required None User Interaction Required
Scope Unchanged Confidentiality Impact High
Integrity Impact High Availability Impact High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score N/A Attack Range N/A
Cvss Impact Score N/A Attack Complexity N/A
Cvss Expoit Score N/A Authentication N/A
Calculate full CVSS 2.0 Vectors scores

Detail

An Executable Hijacking condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.5.3.1. Attackers may load a malicious copy of a Dependency Link Library (DLL) via a local attack vector instead of the DLL that the application was expecting, when processes are running with escalated privileges. This vulnerability is bounded only to the time of uninstallation and can only be exploited locally.

At the time of this disclosure, versions before 4.0 are classified as End of Life.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28140

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-427 Uncontrolled Search Path Element

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 2

Sources (Detail)

Source Url
MISC https://www.qualys.com/security-advisories/

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2023-04-28 17:27:23
  • Multiple Updates
2023-04-18 21:27:17
  • First insertion