7.8

CVE-2023-2847

Local privilege escalation in ESET products for Linux and MacOS

During internal security analysis, a local privilege escalation vulnerability has been identified. On a machine with the affected ESET product installed, it was possible for a user with lower privileges due to improper privilege management to trigger actions with root privileges.

ESET remedied this possible attack vector and has prepared new builds of its products that are no longer susceptible to this vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Eset ≫ Cyber Security Version >= 7.3.0 < 7.3.3700.0
Eset ≫ Endpoint Antivirus SwPlatform linux_kernel Version < 8.1.12.0
Eset ≫ Endpoint Antivirus SwPlatform macos Version >= 7.0.0 < 7.3.3600.0
Eset ≫ Endpoint Antivirus SwPlatform linux_kernel Version >= 9.0.5.0 < 9.0.10.0
Eset ≫ Endpoint Antivirus SwPlatform linux_kernel Version >= 9.1.4.0 < 9.1.11.0
Eset ≫ Server Security SwPlatform linux_kernel Version < 8.1.823.0
Eset ≫ Server Security SwPlatform linux_kernel Version >= 9.0.464.0 < 9.0.466.0
Eset ≫ Server Security SwPlatform linux_kernel Version >= 9.1.96.0 < 9.1.98.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.15% 0.043
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
security@eset.com 7.8 1.1 6
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

https://support.eset.com/en/ca8447
Vendor Advisory