CVE-2024-38492

CWE-77 — Command Injection3 documents3 sources

Severity

9.4CRITICAL

EPSS

1.6%

top 18.49%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Broadcom Symantec Privileged Access Management

Timeline

PublishedJul 15

Description

This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a specially crafted PAM upgrade file.

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Affected Packages1 packages

▶CVEListV5broadcom/symantec_privileged_access_management3.4.6, 4.1.0 - 4.1.7+1

🔴Vulnerability Details

GHSA

GHSA-x26h-97qp-jh49: This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a specially crafted↗2024-07-15

▶

CVEList

Symantec Privileged Access Manager Remote Command Execution vulnerability↗2024-07-15

▶