CVE-2024-34332

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-34332
An issue in SiSoftware SANDRA v31.66 (SANDRA.sys 15.18.1.1) and before allows an attacker to escalate privileges via a crafted buffer sent to the Kernel Driver using the DeviceIoControl Windows API.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://belong2yourself.github.io/vulnerabilities/docs/SANDRA/Elevation-of-Privileges/readme/
https://belong2yourself.github.io/vulnerabilities/docs/SANDRA/Elevation-of-Privileges/readme/
Configurations

No configuration.

History

21 Nov 2024, 09:18

Type Values Removed Values Added
References () https://belong2yourself.github.io/vulnerabilities/docs/SANDRA/Elevation-of-Privileges/readme/ - () https://belong2yourself.github.io/vulnerabilities/docs/SANDRA/Elevation-of-Privileges/readme/ -

03 Jul 2024, 01:59

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
Summary
  • (es) Un problema en SiSoftware SANDRA v31.66 (SANDRA.sys 15.18.1.1) y anteriores permite a un atacante escalar privilegios a través de un búfer manipulado y enviado al controlador del kernel mediante la API de Windows DeviceIoControl.
CWE CWE-269

10 Jun 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-10 16:15

Updated : 2024-11-21 09:18

NVD link : CVE-2024-34332

Mitre link : CVE-2024-34332

CVE.ORG link : CVE-2024-34332

JSON object : View

Products Affected

No product.

CWE
CWE-269

Improper Privilege Management