CVE-2018-16715

{"id": "CVE-2018-16715", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2018-09-08T10:29:01.087", "references": [{"url": "https://community.absolute.com/s/article/Absolute-Security-Bulletin-ASB1", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Absolute Software CTES Windows Agent through 1.0.0.1479. The security permissions on the %ProgramData%\\CTES folder and sub-folders may allow write access to low-privileged user accounts. This allows unauthorized replacement of service program executable (EXE) or dynamically loadable library (DLL) files, causing elevated (SYSTEM) user access. Configuration control files or data files under this folder could also be similarly modified to affect service process behavior."}, {"lang": "es", "value": "Se ha descubierto un problema hasta la versi\u00f3n 1.0.0.1479 de Absolute Software CTES Windows Agent. Los permisos de seguridad en la carpeta y las carpetas %ProgramData%\\CTES podr\u00eda permitir el acceso de escritura a cuentas de usuario con pocos privilegios. Esto permite el reemplazo no autorizado de un EXE del programa de servicio o de archivos DLL (dynamically loadable library), lo que provoca el acceso de usuario elevado (SYSTEM). Los archivos de control de configuraci\u00f3n o de datos en esta carpeta tambi\u00e9n podr\u00edan modificarse para afectar al comportamiento del proceso del servicio."}], "lastModified": "2019-10-03T00:03:26.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:absolute:ctes_windows_agent:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "93F555B4-F541-4AA0-BAAD-A52394B57088", "versionEndIncluding": "1.0.0.1479"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}