CVE-2024-2658 — Uncontrolled Search Path Element in Flexnet Publisher

CWE-427 — Uncontrolled Search Path Element4 documents4 sources
Severity
8.5HIGHNVD
EPSS
0.0%
top 85.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Flexera Flexnet Publisher
Timeline
PublishedJan 30

Description

A misconfiguration in lmadmin.exe of FlexNet Publisher versions prior to 2024 R1 (11.19.6.0) allows the OpenSSL configuration file to load from a non-existent directory. An unauthorized, locally authenticated user with low privileges can potentially create the directory and load a specially crafted openssl.conf file leading to the execution of a malicious DLL (Dynamic-Link Library) with elevated privileges.

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Packages1 packages

▶CVEListV5flexera/flexnet_publisher< 2024 R1 (11.19.6.0)

🔴Vulnerability Details

2
CVEList
Local privilege escalation in FlexNet Publisher↗2025-01-30
▶
GHSA
GHSA-2795-pjw4-5495: A misconfiguration in lmadmin↗2025-01-30
▶
CVE-2024-2658 — Uncontrolled Search Path Element | cvebase