ZDI-CAN-22591: ZDI-24-359: Flexera Software FlexNet Publisher Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
First published: Mon Apr 01 2024(Updated: )
This vulnerability allows local attackers to escalate privileges on affected installations of Flexera Software FlexNet Publisher. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The process loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Flexera FlexNet Publisher | ||
| Flexera FlexNet Publisher |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of ZDI-CAN-22591?
The severity of ZDI-CAN-22591 is significant as it allows local privilege escalation in affected installations of Flexera Software FlexNet Publisher.
How do I fix ZDI-CAN-22591?
To fix ZDI-CAN-22591, users should apply any available security patches or updates released by Flexera Software for FlexNet Publisher.
What kind of attack does ZDI-CAN-22591 enable?
ZDI-CAN-22591 enables local attackers to escalate privileges after executing low-privileged code on the target system.
Which software is affected by ZDI-CAN-22591?
ZDI-CAN-22591 affects Flexera Software FlexNet Publisher installations.
What conditions need to be met to exploit ZDI-CAN-22591?
An attacker must first gain the ability to execute low-privileged code on the target system to exploit ZDI-CAN-22591.
- collector/zdi-published
- source/ZDI
- alias/ZDI-CAN-22591
- agent/title
- agent/last-modified-date
- agent/references
- agent/severity
- agent/first-publish-date
- agent/description
- agent/event
- agent/trending
- agent/type
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/tags
- collector/zdi-advisory
- alias/ZDI-24-359
- alias/CVE-2024-2658
- vendor/flexera software
- canonical/flexera flexnet publisher