CVE-2024-26238

Improper Link Resolution Before File Access ('Link Following') (CWE-59)

Published: May 14, 2024

010
CVSS 7.8EPSS 0.04%High
CVE info copied to clipboard

Summary

Microsoft PLUGScheduler Scheduled Task Elevation of Privilege Vulnerability. This is a local vulnerability with a CVSS base score of 7.8, indicating high severity. The vulnerability is associated with CWE-59: Improper Link Resolution Before File Access ('Link Following'). It affects the Microsoft PLUGScheduler Scheduled Task and can lead to elevation of privilege.

Impact

This vulnerability allows an attacker with low privileges to potentially gain elevated privileges on the affected system. The impact is severe, with high confidentiality, integrity, and availability impacts. An attacker could exploit this to access sensitive information, modify system files, or disrupt system operations.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. Microsoft released an update to address this vulnerability on May 14, 2024.

Mitigation

1. Apply the security update provided by Microsoft as soon as possible. 2. Implement the principle of least privilege to limit the potential impact of this vulnerability. 3. Monitor and audit scheduled tasks and their permissions regularly. 4. Implement strong access controls and user authentication mechanisms. 5. Keep all Microsoft systems and software up to date with the latest security patches.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Timeline

CVSS

A CVSS base score of 7.8 has been assigned.

May 14, 2024 at 5:00 PM / microsoft
First Article

Feedly found the first article mentioning CVE-2024-26238. See article

May 14, 2024 at 5:03 PM / Microsoft Security Advisories - MSRC
CVE Assignment

NVD published the first details for CVE-2024-26238

May 14, 2024 at 5:15 PM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (379811)

May 15, 2024 at 5:15 AM
EPSS

EPSS Score was set to: 0.04% (Percentile: 8.5%)

May 15, 2024 at 9:25 AM
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Jun 5, 2024 at 3:22 AM
EPSS

EPSS Score was set to: 0.04% (Percentile: 10.2%)

Nov 20, 2024 at 3:09 AM
Static CVE Timeline Graph

Affected Systems

Microsoft
+null more

Patches

Microsoft
+null more

Links to Mitre Att&cks

T1547.009: Shortcut Modification
+null more

Attack Patterns

CAPEC-132: Symlink Attack
+null more

News

Researcher Details Windows Elevation of Privilege Vulnerability (CVE-2024-26238)
Security researcher Guillaume André with Synacktiv has detailed a high-severity vulnerability, CVE-2024-26238 (CVSS 7.8)
Researcher Details Windows Elevation of Privilege Vulnerability (CVE-2024-26238)
The key vulnerability arises from the permissive Access Control Lists (ACLs) of the Logs folder, allowing standard users to perform certain operations, such as creating files and folders and writing attributes. The vulnerability stems from how PLUGScheduler, running as SYSTEM, manages file operations within a directory accessible to standard users.
Install KB5037768 to patch the PLUGScheduler vulnerability in Windows 10
Microsoft has flagged a PLUGScheduler security vulnerability (CVE-2024-26238), which allows threat actors to gain access to the affected system. The vulnerability was first reported on Jan 22, 2024, acknowledged by MSRC (Microsoft Security Response Center) on Feb 1, 2024, and a patch for it was released on May 14, 2024, alongside the KB5037768 update.
Windows 10 PLUGScheduler Vulnerability Allows Privilege Escalation
A critical vulnerability in the Windows 10 operating system, tracked as CVE-2024-26238, could allow attackers to gain elevated privileges on affected systems. The flaw resides in the PLUGScheduler component of Windows 10 versions 21H2 and 22H2. PLUGS …
Risky Biz News: Google throws out GlobalTrust certs
Browser makers like Google, Mozilla, Microsoft, and Apple expect that certificate authorities (CAs) like GlobalTrust follow a long list of requirements when running their service and when suffering any kind of technical error or security breach. The incident took place on Friday, a day after security researcher Eric Daigle published details about a vulnerability in the company's app.
See 43 more articles and social media posts

CVSS V3.1

Attack Vector:Local
Attack Complexity:Low
Privileges Required:Low
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI