VulnerabilityModified
CVE-2014-7298
adsetgroups in Centrify Server Suite 2008 through 2014.1 and Centrify DirectControl 3.x through 4.2.0 on Linux and UNIX allows local users to read arbitrary files with root privileges by leveraging improperly protected setuid functionality.
MEDIUM 4.9EPSS 0.37%
Does this matter?
Lower severity and a low EPSS score (0.37%). Track it; it rarely justifies an emergency change on its own.
Description
adsetgroups in Centrify Server Suite 2008 through 2014.1 and Centrify DirectControl 3.x through 4.2.0 on Linux and UNIX allows local users to read arbitrary files with root privileges by leveraging improperly protected setuid functionality.
- CVSS 2.0
- 4.9 MEDIUMAV:L/AC:L/Au:N/C:C/I:N/A:N
- EPSS
- 0.37% probability · 31th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- centrify/directcontrol · centrify/centrify suite
- Source
- cve@mitre.org
References
- http://twitter.com/travemme/statuses/525298393971564544
- http://www.centrify.com/support/announcements.asp#20141014
- https://exploithub.com/centrify-data-leakage.html
- http://twitter.com/travemme/statuses/525298393971564544
- http://www.centrify.com/support/announcements.asp#20141014
- https://exploithub.com/centrify-data-leakage.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.