VulnerabilityAnalyzed

CVE-2024-7061

Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking.

HIGH 7.8EPSS 0.21%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.21%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To remediate this vulnerability, upgrade to 5.0.2 or greater.

CVSS 3.1: 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.21% probability · 12th percentile
CISA KEV: Not listed
Weakness: CWE-22, CWE-427
Affected: okta/verify
Source: psirt@okta.com

References

https://help.okta.com/oie/en-us/content/topics/releasenotes/oie-ov-release-notes.htm#panel4Not Applicable, Release Notes
https://trust.okta.com/security-advisories/okta-verify-for-windows-privilege-escalation-cve-2024-7061/Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.