QID 378360

Date Published: 2023-04-18

QID 378360: Qualys Cloud Agent For Windows prior to 4.8.0.31 NTFS Junction Exploitation Vulnerability (Q-PVD-2023-02)

An NTFS Junction condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.8.0.31. Attackers may write files to arbitrary locations via a local attack vector. This allows attackers to assume the privileges of the process, and they may delete or otherwise take action on unauthorized files, allowing for the potential modification or deletion of sensitive files limited only to that specific directory/file object. This vulnerability is bounded to the time of installation/uninstallation and can only be exploited locally.

At the time of this disclosure, versions before 4.0 are classified as End of Life.

Affected Version:
Qualys Cloud Agent for Windows prior to 4.8.0.31

QID Detection Logic:
Operating System: Windows
The detections checks for QualysAgent.exe versions before 4.8.0.31

Successful exploitation allows attackers to assume the privileges of the process, and they may delete or otherwise take action on unauthorized files, allowing for the potential modification or deletion of sensitive files limited only to that specific directory/file object.

  • CVSS V3 rated as High - 6.3 severity.
  • CVSS V2 rated as High - 6 severity.
    • Solution
    Customers are advised to upgrade to v4.8.0.31 or higher of Qualys Cloud Agent for Windows. If possible, customers should enable automatic updates.

    Vendor References

    CVEs related to QID 378360

    CVE-2023-28141 |
    Software Advisories
    Advisory ID Software Component Link
    Q-PVD-2023-02 URL Logo www.qualys.com/security-advisories/cve-2023-28141/
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].