Skip to content
OpenAdvisories
High · 7.8 CVE-2024-0394 EUVD-2024-16190GHSA-5q37-x55w-w66j

Rapid7 Minerva Armor Privilege Escalation

Published Apr 3, 2024 · Updated Aug 22, 2024 · Assigned by rapid7

Description

Rapid7 Minerva Armor versions below 4.5.5 suffer from a privilege escalation vulnerability whereby an authenticated attacker can elevate privileges and execute arbitrary code with SYSTEM privilege.  The vulnerability is caused by the product's implementation of OpenSSL's`OPENSSLDIR` parameter where it is set to a path accessible to low-privileged users.  The vulnerability has been remediated and fixed in version 4.5.5. 

Affected products

VendorProductAffectedFixed
Rapid7 Minerva < 4.5.5 4.5.5

References