CVE-2024-23908

Insecure inherited permissions in some Flexlm License Daemons for Intel(R) FPGA software before version v11.19.5.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01107.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:intel:flexlm_license_daemons_for_intel_fpga:*:*:*:*:*:*:*:*

History

12 Sep 2024, 18:43

Type	Values Removed	Values Added
CWE		CWE-732
References	~~() https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01107.html -~~	() https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01107.html - Vendor Advisory
First Time		Intel Intel flexlm License Daemons For Intel Fpga
Summary		(es) Los permisos heredados inseguros en algunos Flexlm License Daemons para el software Intel(R) FPGA anteriores a la versión v11.19.5.0 pueden permitir que un usuario autenticado habilite potencialmente la escalada de privilegios a través del acceso local.
CVSS	v2 : ~~unknown~~ v3 : ~~6.7~~	v2 : unknown v3 : 7.8
CPE		cpe:2.3:a:intel:flexlm_license_daemons_for_intel_fpga::::::::

14 Aug 2024, 14:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-14 14:15

Updated : 2024-09-12 18:43

NVD link : CVE-2024-23908

Mitre link : CVE-2024-23908

CVE.ORG link : CVE-2024-23908

JSON object : View

Products Affected

intel

flexlm_license_daemons_for_intel_fpga

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

CWE-277

Insecure Inherited Permissions

{"id": "CVE-2024-23908", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "secure@intel.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}], "cvssMetricV40": [{"type": "Secondary", "source": "secure@intel.com", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 5.4, "automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "NONE", "vulnerableSystemIntegrity": "HIGH", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "vulnerableSystemAvailability": "HIGH", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "HIGH", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-08-14T14:15:20.210", "references": [{"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01107.html", "tags": ["Vendor Advisory"], "source": "secure@intel.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}, {"type": "Secondary", "source": "secure@intel.com", "description": [{"lang": "en", "value": "CWE-277"}]}], "descriptions": [{"lang": "en", "value": "Insecure inherited permissions in some Flexlm License Daemons for Intel(R) FPGA software before version v11.19.5.0 may allow an authenticated user to potentially enable escalation of privilege via local access."}, {"lang": "es", "value": " Los permisos heredados inseguros en algunos Flexlm License Daemons para el software Intel(R) FPGA anteriores a la versi\u00f3n v11.19.5.0 pueden permitir que un usuario autenticado habilite potencialmente la escalada de privilegios a trav\u00e9s del acceso local."}], "lastModified": "2024-09-12T18:43:53.363", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:intel:flexlm_license_daemons_for_intel_fpga:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5B2DDCEE-5825-4809-8B01-B3B031A210DD", "versionEndExcluding": "11.19.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "secure@intel.com"}