ZDI-24-359: Flexera Software FlexNet Publisher Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
First published: Mon Apr 01 2024(Updated: )
This vulnerability allows local attackers to escalate privileges on affected installations of Flexera Software FlexNet Publisher. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The process loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Flexera FlexNet Publisher | ||
| Flexera FlexNet Publisher |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of ZDI-24-359?
The severity of ZDI-24-359 is classified as a privilege escalation vulnerability.
How do I fix ZDI-24-359?
To fix ZDI-24-359, update to the latest version of Flexera Software FlexNet Publisher that addresses this specific vulnerability.
Who is affected by the ZDI-24-359 vulnerability?
The ZDI-24-359 vulnerability affects all installations of Flexera Software FlexNet Publisher that are running vulnerable versions.
What type of attack does ZDI-24-359 enable?
ZDI-24-359 enables local attackers to escalate their privileges on affected systems.
What is required to exploit ZDI-24-359?
An attacker must first gain the ability to execute low-privileged code on the system to exploit ZDI-24-359.
- collector/zdi-published
- source/ZDI
- alias/ZDI-CAN-22591
- agent/title
- agent/last-modified-date
- agent/references
- agent/severity
- agent/first-publish-date
- agent/description
- agent/type
- agent/event
- agent/trending
- agent/source
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/zdi-advisory
- alias/ZDI-24-359
- alias/CVE-2024-2658
- vendor/flexera software
- canonical/flexera flexnet publisher