CVE-2023-26603

Published: Apr 26, 2024Modified: Jun 17, 2026Deferred

5.9

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability: 2.5 / Impact: 3.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

JumpCloud Agent before 1.178.0 Creates a Temporary File in a Directory with Insecure Permissions. This allows privilege escalation to SYSTEM via a repair action in the installer.

Related CWEs

CWE-378

Creation of Temporary File With Insecure Permissions

Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.

References (4)

https://community.jumpcloud.com/t5/jumpcloud-product-news/bd-p/releases

Source: cve@mitre.org

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2024/MNDT-2024-0003.md

Source: cve@mitre.org

https://community.jumpcloud.com/t5/jumpcloud-product-news/bd-p/releases

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2024/MNDT-2024-0003.md

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.