7.8

CVE-2023-2847

During internal security analysis, a local privilege escalation vulnerability has been identified. On a machine with the affected ESET product installed, it was possible for a user with lower privileges due to improper privilege management to trigger actions with root privileges.

ESET remedied this possible attack vector and has prepared new builds of its products that are no longer susceptible to this vulnerability.

Data is provided by the National Vulnerability Database (NVD)
Eset ≫ Cyber Security Version >= 7.3.0 < 7.3.3700.0
Eset ≫ Endpoint Antivirus SwPlatformlinux_kernel Version < 8.1.12.0
Eset ≫ Endpoint Antivirus SwPlatformmacos Version >= 7.0.0 < 7.3.3600.0
Eset ≫ Endpoint Antivirus SwPlatformlinux_kernel Version >= 9.0.5.0 < 9.0.10.0
Eset ≫ Endpoint Antivirus SwPlatformlinux_kernel Version >= 9.1.4.0 < 9.1.11.0
Eset ≫ Server Security SwPlatformlinux_kernel Version < 8.1.823.0
Eset ≫ Server Security SwPlatformlinux_kernel Version >= 9.0.464.0 < 9.0.466.0
Eset ≫ Server Security SwPlatformlinux_kernel Version >= 9.1.96.0 < 9.1.98.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.04% 0.127
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
security@eset.com 7.8 1.1 6
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.