CVE-2024-49360: Detailed Vulnerability Analysis and Overview

Status: Received - Published on 29-11-2024

CVE-2024-49360
Vulnerability Scoring

9.2
/10

Attack Complexity Details

  • Attack Complexity: Low Impact
  • Attack Vector: LOCAL
  • Privileges Required: None
  • Scope: CHANGED
  • User Interaction: NONE

CIA Impact Definition

  • Confidentiality: HIGH IMPACT
  • Integrity: HIGH IMPACT
  • Availability: Low Impact

CVE-2024-49360 Vulnerability Summary

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. An authenticated user (**UserA**) with no privileges is authorized to read all files created in sandbox belonging to other users in the sandbox folders `C:\Sandbox\UserB\xxx`. An authenticated attacker who can use `explorer.exe` or `cmd.exe` outside any sandbox can read other users' files in `C:\Sandbox\xxx`. By default in Windows 7+, the `C:\Users\UserA` folder is not readable by **UserB**. All files edited or created during the sandbox processing are affected by the vulnerability. All files in C:\Users are safe. If `UserB` runs a cmd in a sandbox, he will be able to access `C:\Sandox\UserA`. In addition, if **UserB** create a folder `C:\Sandbox\UserA` with malicious ACLs, when **UserA** will user the sandbox, Sandboxie doesn't reset ACLs ! This issue has not yet been fixed. Users are advised to limit access to their systems using Sandboxie.

Access Complexity Graph for CVE-2024-49360

Impact Analysis for CVE-2024-49360

CVE-2024-49360: Detailed Information and External References

EPSS

0.00043

EPSS %

0.10702

References

0.00043

CWE

CWE-22

CAPEC

0.00043

CVSS3 Source

security-advisories@github.com

CVSS3 Type

Secondary

CVSS3 Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Protect Your Infrastructure: Combat Critical CVE Threats

Stay updated with real-time CVE vulnerabilities and take action to secure your systems. Enhance your cybersecurity posture with the latest threat intelligence and mitigation techniques. Develop the skills necessary to defend against CVEs and secure critical infrastructures. Advance your expertise with certifications like Certified Ethical Hacker (CEH) and CISSP ISC2. These certifications equip you with proactive strategies to address vulnerabilities and strengthen your organization's defenses against emerging cyber threats. Gain the tools and certifications to stay ahead of evolving CVE threats.

Join the top cybersecurity professionals safeguarding today's infrastructures.

Recently Published CVEs