CVE-2024-23764: withsecure client_security Improper Privilege Management

Vulnerability summary

CVE-2024-23764 is a medium (CVSS 6.7) Improper Privilege Management vulnerability in withsecure client_security. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.4% of scored vulnerabilities.

Timeline

1. 08-02-2024
   PublishedVulnerability first disclosed.
2. 15-05-2025
   Last modifiedVulnerability information updated.

Description

Certain WithSecure products allow Local Privilege Escalation. This affects WithSecure Client Security 15 and later, WithSecure Server Security 15 and later, WithSecure Email and Server Security 15 and later, and WithSecure Elements Endpoint Protection 17 and later.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.