CVE-2024-49051

Improper Link Resolution Before File Access ('Link Following') (CWE-59)

Published: Nov 12, 2024

010
CVSS 7.8EPSS 0.04%High
CVE info copied to clipboard

Summary

Microsoft PC Manager is affected by an Elevation of Privilege Vulnerability. This vulnerability is related to improper link resolution before file access, also known as 'link following'. It allows a local attacker with low privileges to potentially gain higher privileges on the system. The vulnerability has a CVSS v3.1 base score of 7.8, indicating a high severity level. The attack vector is local, requiring low attack complexity and low privileges, with no user interaction needed.

Impact

If exploited, this vulnerability could allow an attacker to elevate their privileges on the affected system. With elevated privileges, the attacker could potentially execute arbitrary code, install programs, view, change, or delete data, or create new accounts with full user rights. The impact on confidentiality, integrity, and availability is considered high. This could lead to significant compromises in system security and data protection.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available for this vulnerability. Microsoft released the patch on November 12, 2024. It is crucial for the security team to apply this patch as soon as possible to mitigate the risk.

Mitigation

1. Apply the security update provided by Microsoft immediately. 2. Implement the principle of least privilege, ensuring users operate with minimal necessary permissions. 3. Regularly monitor and audit system activities, especially those involving file access and privilege changes. 4. Keep the Microsoft PC Manager software updated to the latest version. 5. Implement additional access controls and security measures to restrict local access to the system. 6. Consider using application whitelisting to prevent unauthorized software execution. 7. Educate users about the risks of running untrusted software or clicking on suspicious links, even though this vulnerability doesn't require user interaction.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Timeline

CVSS

A CVSS base score of 7.8 has been assigned.

Nov 12, 2024 at 5:55 PM / microsoft
First Article

Feedly found the first article mentioning CVE-2024-49051. See article

Nov 12, 2024 at 6:10 PM / Vulners.com RSS Feed
CVE Assignment

NVD published the first details for CVE-2024-49051

Nov 12, 2024 at 6:15 PM
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Nov 12, 2024 at 6:36 PM
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Nov 12, 2024 at 7:08 PM
EPSS

EPSS Score was set to: 0.04% (Percentile: 10.1%)

Nov 13, 2024 at 5:06 PM
EPSS

EPSS Score was set to: 0.04% (Percentile: 10.2%)

Nov 18, 2024 at 8:39 PM
Static CVE Timeline Graph

Affected Systems

Microsoft/pc_manager
+null more

Patches

Microsoft
+null more

Links to Mitre Att&cks

T1547.009: Shortcut Modification
+null more

Attack Patterns

CAPEC-132: Symlink Attack
+null more

References

Microsoft PC Manager Elevation of Privilege Vulnerability
What privileges could be gained by an attacker who successfully exploited the vulnerability? How could an attacker exploit this vulnerability?

News

Microsoft PC Manager Elevation of Privilege Vulnerability
What privileges could be gained by an attacker who successfully exploited the vulnerability? How could an attacker exploit this vulnerability?
2024-45 - Adobe, Mozilla, Canonical, Red Hat, Microsoft, Google, Jenkins, GitHub, Spring 🗂️
Advisory Week Week 45, 2024 National Cyber Awareness System CISA Releases Nineteen Industrial Control Systems Advisories CISA Adds Two Known Exploited Vulnerabilities to Catalog Palo Alto Networks Emphasizes Hardening Guidance Fortinet Releases Security Updates for Multiple Products Microsoft Releases November 2024 Security Updates Adobe Releases Security Updates for Multiple Products Ivanti Releases Security Updates for Multiple Products JCDC’s Collaborative Efforts Enhance Cybersecurity for the 2024 Olympic and Paralympic Games Citrix Releases Security Updates for NetScaler and Citrix Session Recording CISA Releases Five Industrial Control Systems Advisories CISA, FBI, NSA, and International Partners Release Joint Advisory on 2023 Top Routinely Exploited Vulnerabilities CISA Adds Five Known Exploited Vulnerabilities to Catalog Adobe Security Bulletins and Advisories Security updates available for Adobe Photoshop APSB24-89 Security Updates Available for Adobe Commerce APSB24-90 Security Updates Available for Adobe Illustrator APSB24-66 APSB24-87 Security Update Available for Adobe InDesign APSB24-88 Security Updates Available for Adobe Bridge APSB24-77 Security Updates Available for Adobe Audition APSB24-83 Mozilla Security Advisories Security Vulnerabilities fixed in Thunderbird 132.0.1 mfsa2024-62 Security Vulnerabilities fixed in Thunderbird 128.4.3 mfsa2024-61 Ubuntu Security Notices Linux kernel vulnerabilities: USN-7089-6 / USN-7088-5 / USN-7089-5 / USN-7110-1 / USN-7089-4 / USN-7100-2 / USN-7100-1 GD Graphics Library vulnerability: USN-7112-1 Go vulnerabilities: USN-7111-1 / USN-7109-1 Linux kernel vulnerability:
Microsoft’s Security Update in November on High-Risk Vulnerabilities in Multiple Products
On November 13, NSFOCUS CERT detected that Microsoft released a security update patch for November, which fixed 89 security issues, including Windows, Microsoft SQL Server, Microsoft Office, Azure, Open Source Software, Microsoft Visual Studio, System Center and other widely used products, including high-risk vulnerabilities such as privilege escalation vulnerability and remote code execution vulnerability. Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
November Patch Tuesday loads up everyone’s plate – Sophos News
We are as always including at the end of this post additional appendices listing all Microsoft’s patches, sorted by severity, by predicted exploitability, and by product family. This Important-severity spoofing vulnerability, which Microsoft believes to be more likely to be exploited within the next 30 days, has a rather specific set of post-installation instructions, which can be seen on the company’s site.
Microsoft Security Bulletin Coverage for November 2024
SonicWall Capture Labs threat research team has analyzed and addressed Microsoft’s security advisories for the month of November2024 and has produced coverage for 6 of the reported vulnerabilities CVE CVE Title CVE-2024-49049 Visual Studio Code Remote Extension Elevation of Privilege Vulnerability
See 28 more articles and social media posts

CVSS V3.1

Attack Vector:Local
Attack Complexity:Low
Privileges Required:Low
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI