Vulnerabilites related to thalesgroup - safenet_authentication_client
Vulnerability from fkie_nvd
Published
2024-02-27 11:15
Modified
2025-03-04 18:57
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
A flaw in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to execute code at a SYSTEM level via local access.
References
Impacted products
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client:*:*:*:*:*:*:*:*", "matchCriteriaId": "C1A4278F-3A51-4996-BA41-63EAFDC94679", "versionEndExcluding": "10.8", "vulnerable": true }, { "criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client:10.8:-:*:*:*:*:*:*", "matchCriteriaId": "D1CFFB1B-9F22-48FE-86C1-72C09C57A95C", "vulnerable": true }, { "criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client:10.8:r1:*:*:*:*:*:*", "matchCriteriaId": "4FB4DA9F-D19B-41E9-BB88-7C24E48ADEE2", "vulnerable": true }, { "criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client:10.8:r5:*:*:*:*:*:*", "matchCriteriaId": "8D9E5B18-464C-4BD8-9A13-00AA985350DE", "vulnerable": true }, { "criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client:10.8:r6:*:*:*:*:*:*", "matchCriteriaId": "70665411-4646-48D3-A25B-423233D85D54", "vulnerable": true }, { "criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client:10.8:r8:*:*:*:*:*:*", "matchCriteriaId": "1B5FD010-0AE2-4FDC-84C6-24EBE5C79932", "vulnerable": true }, { "criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client:10.8:r9:*:*:*:*:*:*", "matchCriteriaId": "79DCB763-95ED-4D17-956E-DC4ED5D7212D", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "A flaw in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to execute code at a SYSTEM level via local access." }, { "lang": "es", "value": "Una falla en Thales SafeNet Authentication Client anterior a 10.8 R10 en Windows permite a un atacante ejecutar c\u00f3digo a nivel de SYSTEM a trav\u00e9s de acceso local." } ], "id": "CVE-2023-7016", "lastModified": "2025-03-04T18:57:43.117", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "psirt@thalesgroup.com", "type": "Secondary" }, { "cvssData": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2024-02-27T11:15:07.933", "references": [ { "source": "psirt@thalesgroup.com", "tags": [ "Product" ], "url": "https://supportportal.thalesgroup.com" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Product" ], "url": "https://supportportal.thalesgroup.com" } ], "sourceIdentifier": "psirt@thalesgroup.com", "vulnStatus": "Analyzed", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-269" } ], "source": "psirt@thalesgroup.com", "type": "Secondary" }, { "description": [ { "lang": "en", "value": "NVD-CWE-noinfo" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
Vulnerability from fkie_nvd
Published
2022-06-24 17:15
Modified
2024-11-21 06:27
Severity ?
Summary
Thales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a local attacker, through a symlink attack, to overwrite arbitrary files, and potentially achieve arbitrary command execution with high privileges.
References
▼ | URL | Tags | |
---|---|---|---|
cve@mitre.org | https://github.com/z00z00z00/Safenet_SAC_CVE-2021-42056 | Exploit, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://github.com/z00z00z00/Safenet_SAC_CVE-2021-42056 | Exploit, Third Party Advisory |
Impacted products
Vendor | Product | Version | |
---|---|---|---|
thalesgroup | safenet_authentication_client | * | |
linux | linux_kernel | - | |
microsoft | windows | - |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client:*:*:*:*:*:*:*:*", "matchCriteriaId": "A077A354-8FB8-448D-9F51-175AD21F2388", "versionEndIncluding": "10.7.7", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false }, { "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Thales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a local attacker, through a symlink attack, to overwrite arbitrary files, and potentially achieve arbitrary command execution with high privileges." }, { "lang": "es", "value": "Thales Safenet Authentication Client (SAC) para Linux y Windows versiones hasta 10.7.7, crea archivos temporales de ocultaci\u00f3n y bloqueo no seguros que permiten a un atacante local, mediante un ataque de enlace simb\u00f3lico, sobrescribir archivos arbitrarios, y potencialmente lograr una ejecuci\u00f3n de comandos arbitrarios con altos privilegios" } ], "id": "CVE-2021-42056", "lastModified": "2024-11-21T06:27:09.527", "metrics": { "cvssMetricV2": [ { "acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0" }, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false } ], "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2022-06-24T17:15:08.467", "references": [ { "source": "cve@mitre.org", "tags": [ "Exploit", "Third Party Advisory" ], "url": "https://github.com/z00z00z00/Safenet_SAC_CVE-2021-42056" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Third Party Advisory" ], "url": "https://github.com/z00z00z00/Safenet_SAC_CVE-2021-42056" } ], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-59" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
Vulnerability from fkie_nvd
Published
2024-02-27 11:15
Modified
2025-03-04 19:06
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
A flaw in the Windows Installer in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to escalate their privilege level via local access.
References
Impacted products
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client:*:*:*:*:*:*:*:*", "matchCriteriaId": "C1A4278F-3A51-4996-BA41-63EAFDC94679", "versionEndExcluding": "10.8", "vulnerable": true }, { "criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client:10.8:-:*:*:*:*:*:*", "matchCriteriaId": "D1CFFB1B-9F22-48FE-86C1-72C09C57A95C", "vulnerable": true }, { "criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client:10.8:r1:*:*:*:*:*:*", "matchCriteriaId": "4FB4DA9F-D19B-41E9-BB88-7C24E48ADEE2", "vulnerable": true }, { "criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client:10.8:r5:*:*:*:*:*:*", "matchCriteriaId": "8D9E5B18-464C-4BD8-9A13-00AA985350DE", "vulnerable": true }, { "criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client:10.8:r6:*:*:*:*:*:*", "matchCriteriaId": "70665411-4646-48D3-A25B-423233D85D54", "vulnerable": true }, { "criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client:10.8:r8:*:*:*:*:*:*", "matchCriteriaId": "1B5FD010-0AE2-4FDC-84C6-24EBE5C79932", "vulnerable": true }, { "criteria": "cpe:2.3:a:thalesgroup:safenet_authentication_client:10.8:r9:*:*:*:*:*:*", "matchCriteriaId": "79DCB763-95ED-4D17-956E-DC4ED5D7212D", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "A flaw in the Windows Installer in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to escalate their privilege level via local access." }, { "lang": "es", "value": "Una falla en el instalador de Windows en Thales SafeNet Authentication Client anterior a 10.8 R10 en Windows permite a un atacante escalar su nivel de privilegios a trav\u00e9s del acceso local." } ], "id": "CVE-2023-5993", "lastModified": "2025-03-04T19:06:06.813", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "psirt@thalesgroup.com", "type": "Secondary" }, { "cvssData": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2024-02-27T11:15:07.343", "references": [ { "source": "psirt@thalesgroup.com", "tags": [ "Product" ], "url": "https://supportportal.thalesgroup.com" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Product" ], "url": "https://supportportal.thalesgroup.com" } ], "sourceIdentifier": "psirt@thalesgroup.com", "vulnStatus": "Analyzed", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-269" } ], "source": "psirt@thalesgroup.com", "type": "Secondary" }, { "description": [ { "lang": "en", "value": "NVD-CWE-noinfo" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
CVE-2023-5993 (GCVE-0-2023-5993)
Vulnerability from cvelistv5
Published
2024-02-27 10:42
Modified
2024-08-08 19:28
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-269 - Improper Privilege Management
Summary
A flaw in the Windows Installer in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to escalate their privilege level via local access.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Thales | SafeNet Authentication Client |
Version: 0 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T08:14:25.122Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://supportportal.thalesgroup.com" } ], "title": "CVE Program Container" }, { "affected": [ { "cpes": [ "cpe:2.3:a:thalesgroup:safenet_authentication_client:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "safenet_authentication_client", "vendor": "thalesgroup", "versions": [ { "lessThan": "10.8", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2023-5993", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-02-27T15:39:53.382676Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-08-08T19:28:36.205Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "platforms": [ "Windows" ], "product": "SafeNet Authentication Client", "vendor": "Thales", "versions": [ { "lessThan": "10.8", "status": "affected", "version": "0", "versionType": "patch 10" } ] } ], "credits": [ { "lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Kravets Vasiliy, xi-tauw@xi-tauw.info" } ], "datePublic": "2024-02-18T23:00:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "A flaw in the Windows Installer in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to escalate their privilege level via local access." } ], "value": "A flaw in the Windows Installer in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to escalate their privilege level via local access." } ], "impacts": [ { "capecId": "CAPEC-233", "descriptions": [ { "lang": "en", "value": "CAPEC-233 Privilege Escalation" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-02-27T10:42:08.287Z", "orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "shortName": "THA-PSIRT" }, "references": [ { "url": "https://supportportal.thalesgroup.com" } ], "solutions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Upgrade to the current SafeNet Authentication Client 10.8 R10 (GA)." } ], "value": "Upgrade to the current SafeNet Authentication Client 10.8 R10 (GA)." } ], "source": { "discovery": "EXTERNAL" }, "title": "Privilege Escalation in SafeNet Authentication Client Installer", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "assignerShortName": "THA-PSIRT", "cveId": "CVE-2023-5993", "datePublished": "2024-02-27T10:42:08.287Z", "dateReserved": "2023-11-07T16:29:48.850Z", "dateUpdated": "2024-08-08T19:28:36.205Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2021-42056 (GCVE-0-2021-42056)
Vulnerability from cvelistv5
Published
2022-06-24 16:14
Modified
2024-08-04 03:22
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Thales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a local attacker, through a symlink attack, to overwrite arbitrary files, and potentially achieve arbitrary command execution with high privileges.
References
▼ | URL | Tags |
---|---|---|
https://github.com/z00z00z00/Safenet_SAC_CVE-2021-42056 | x_refsource_MISC |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T03:22:25.925Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/z00z00z00/Safenet_SAC_CVE-2021-42056" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "descriptions": [ { "lang": "en", "value": "Thales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a local attacker, through a symlink attack, to overwrite arbitrary files, and potentially achieve arbitrary command execution with high privileges." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2022-06-24T16:14:23", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/z00z00z00/Safenet_SAC_CVE-2021-42056" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2021-42056", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Thales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a local attacker, through a symlink attack, to overwrite arbitrary files, and potentially achieve arbitrary command execution with high privileges." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/z00z00z00/Safenet_SAC_CVE-2021-42056", "refsource": "MISC", "url": "https://github.com/z00z00z00/Safenet_SAC_CVE-2021-42056" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2021-42056", "datePublished": "2022-06-24T16:14:23", "dateReserved": "2021-10-07T00:00:00", "dateUpdated": "2024-08-04T03:22:25.925Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }