CVE-2024-2658: Flexera Software FlexNet Publisher Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
First published: Thu Jan 30 2025(Updated: )
A misconfiguration in lmadmin.exe of FlexNet Publisher versions prior to 2024 R1 (11.19.6.0) allows the OpenSSL configuration file to load from a non-existent directory. An unauthorized, locally authenticated user with low privileges can potentially create the directory and load a specially crafted openssl.conf file leading to the execution of a malicious DLL (Dynamic-Link Library) with elevated privileges.
Credit: PSIRT-CNA@flexerasoftware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Flexera FlexNet Publisher |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://community.flexera.com/s/article/cve-2024-2658-flexnet-publisher-potential-local-privilege-escalation-issue
- https://www.zerodayinitiative.com/advisories/ZDI-24-359/
- https://community.flexera.com/t5/FlexNet-Publisher-Knowledge-Base/CVE-2024-2658-FlexNet-Publisher-potential-local-privilege/ta-p/313003
Frequently Asked Questions
What is the severity of CVE-2024-2658?
CVE-2024-2658 has been rated as a medium severity vulnerability due to its potential for local privilege escalation.
How do I fix CVE-2024-2658?
To fix CVE-2024-2658, update FlexNet Publisher to version 2024 R1 (11.19.6.0) or later.
Who is affected by CVE-2024-2658?
CVE-2024-2658 affects users of FlexNet Publisher versions prior to 2024 R1 (11.19.6.0).
What type of vulnerability is CVE-2024-2658?
CVE-2024-2658 is a local privilege escalation vulnerability due to a misconfiguration in lmadmin.exe.
Can CVE-2024-2658 be exploited remotely?
CVE-2024-2658 cannot be exploited remotely as it requires local authentication and low privileges.
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/severity
- agent/weakness
- agent/title
- agent/last-modified-date
- agent/references
- agent/author
- agent/source
- agent/description
- agent/type
- agent/first-publish-date
- agent/event
- agent/tags
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-24-359
- alias/ZDI-CAN-22591
- alias/CVE-2024-2658
- agent/software-canonical-lookup
- agent/softwarecombine
- vendor/flexera software
- canonical/flexera flexnet publisher