Products
ThermoscanIP_Scrutation
Source
prodsec@nozominetworks.com
Tags
CVE-2024-31201 details
Published : July 31, 2024, 2:15 p.m.
Last Modified : July 31, 2024, 2:15 p.m.
Last Modified : July 31, 2024, 2:15 p.m.
Description
A “CWE-428: Unquoted Search Path or Element” affects the ThermoscanIP_Scrutation service. Such misconfiguration could be abused in scenarios where incorrect permissions were assigned to the C:\ path to attempt a privilege escalation on the local machine.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6.5 | 7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-428 | Unquoted Search Path or Element | The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. |
CVSS Data
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Base Score
6.5
Exploitability Score
0.6
Impact Score
5.9
Base Severity
MEDIUM
Vector String : CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
References
| URL | Source |
|---|---|
| https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31201 | prodsec@nozominetworks.com |
This website uses the NVD API, but is not approved or certified by it.