VulnerabilityDeferred
CVE-2024-4461
Unquoted path or search item vulnerability in SugarSync versions prior to 4.1.3 for Windows.
HIGH 7.8EPSS 0.17%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Unquoted path or search item vulnerability in SugarSync versions prior to 4.1.3 for Windows. This misconfiguration could allow an unauthorized local user to inject arbitrary code into the unquoted service path, resulting in privilege escalation.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.17% probability · 7th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-428
- Source
- cve-coordination@incibe.es
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.