CVE-2024-11859 - Vulnerability Details

Link	Providers
https://support.eset.com/en/ca8810-dll-search-order-hijacking-vulnerability-in-eset-products-for-windows-fixed

Type	Values Removed	Values Added
Metrics	cvssV4_0 `{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`	cvssV4_0 `{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its code.
Title		DLL Search Order Hijacking in ESET products for Windows
Weaknesses		CWE-427
References		https://support.eset.com/en/ca8810-dll-search-order-hijacking-vulnerability-in-eset-products-for-windows-fixed
Metrics		cvssV4_0 `{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-11859", "assignerOrgId": "4a9b9929-2450-4021-b7b9-469a0255b215", "state": "PUBLISHED", "assignerShortName": "ESET", "dateReserved": "2024-11-27T11:06:09.575Z", "datePublished": "2025-04-07T08:08:22.127Z", "dateUpdated": "2025-04-16T10:52:29.591Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ESET NOD32 Antivirus", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "18.0.12.0", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "ESET Internet Security", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "18.0.12.0", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "ESET Smart Security Premium", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "18.0.12.0", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "ESET Security Ultimate", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "18.0.12.0", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "ESET Endpoint Antivirus for Windows", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "12.0.2038.0", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThanOrEqual": "11.1.2053.2", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "ESET Endpoint Security for Windows", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "12.0.2038.0", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThanOrEqual": "11.1.2053.2", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "ESET Small Business Security", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "18.0.12.0", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "ESET Safe Server", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "18.0.12.0", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "ESET Server Security for Windows Server", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "11.1.12005.2", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "ESET Mail Security for Microsoft Exchange Server", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "11.1.10008.0", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThanOrEqual": "11.0.10008.0", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThanOrEqual": "10.1.10014.0", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "ESET Security for Microsoft SharePoint Server", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "11.1.15001.0", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThanOrEqual": "11.0.15004.0", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThanOrEqual": "10.0.15005.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "datePublic": "2025-04-04T20:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its code."}], "value": "DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its code."}], "impacts": [{"capecId": "CAPEC-471", "descriptions": [{"lang": "en", "value": "CAPEC-471 Search Order Hijacking"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 8.4, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4a9b9929-2450-4021-b7b9-469a0255b215", "shortName": "ESET", "dateUpdated": "2025-04-16T10:52:29.591Z"}, "references": [{"url": "https://support.eset.com/en/ca8810-dll-search-order-hijacking-vulnerability-in-eset-products-for-windows-fixed"}], "source": {"advisory": "CA8810", "discovery": "UNKNOWN"}, "title": "DLL Search Order Hijacking in ESET products for Windows", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-07T16:33:40.931389Z", "id": "CVE-2024-11859", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-07T16:35:08.284Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-11859 (string)

assignerOrgId : 4a9b9929-2450-4021-b7b9-469a0255b215 (string)

state : PUBLISHED (string)

assignerShortName : ESET (string)

dateReserved : 2024-11-27T11:06:09.575Z (string)

datePublished : 2025-04-07T08:08:22.127Z (string)

dateUpdated : 2025-04-16T10:52:29.591Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : ESET NOD32 Antivirus (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 18.0.12.0 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

1 : { »

defaultStatus : unaffected (string)

product : ESET Internet Security (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 18.0.12.0 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

2 : { »

defaultStatus : unaffected (string)

product : ESET Smart Security Premium (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 18.0.12.0 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

3 : { »

defaultStatus : unaffected (string)

product : ESET Security Ultimate (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 18.0.12.0 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

4 : { »

defaultStatus : unaffected (string)

product : ESET Endpoint Antivirus for Windows (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 12.0.2038.0 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

1 : { »

lessThanOrEqual : 11.1.2053.2 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

5 : { »

defaultStatus : unaffected (string)

product : ESET Endpoint Security for Windows (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 12.0.2038.0 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

1 : { »

lessThanOrEqual : 11.1.2053.2 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

6 : { »

defaultStatus : unaffected (string)

product : ESET Small Business Security (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 18.0.12.0 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

7 : { »

defaultStatus : unaffected (string)

product : ESET Safe Server (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 18.0.12.0 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

8 : { »

defaultStatus : unaffected (string)

product : ESET Server Security for Windows Server (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 11.1.12005.2 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

9 : { »

defaultStatus : unaffected (string)

product : ESET Mail Security for Microsoft Exchange Server (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 11.1.10008.0 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

1 : { »

lessThanOrEqual : 11.0.10008.0 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

2 : { »

lessThanOrEqual : 10.1.10014.0 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

10 : { »

defaultStatus : unaffected (string)

product : ESET Security for Microsoft SharePoint Server (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 11.1.15001.0 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

1 : { »

lessThanOrEqual : 11.0.15004.0 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

2 : { »

lessThanOrEqual : 10.0.15005.1 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

]

datePublic : 2025-04-04T20:00:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its code. (string)

}

]

value : DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its code. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-471 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-471 Search Order Hijacking (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV4_0 : { »

Automatable : NOT_DEFINED (string)

Recovery : NOT_DEFINED (string)

Safety : NOT_DEFINED (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

attackVector : LOCAL (string)

baseScore : 8.4 (number)

baseSeverity : HIGH (string)

privilegesRequired : LOW (string)

providerUrgency : NOT_DEFINED (string)

subAvailabilityImpact : NONE (string)

subConfidentialityImpact : NONE (string)

subIntegrityImpact : NONE (string)

userInteraction : NONE (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N (string)

version : 4.0 (string)

vulnAvailabilityImpact : NONE (string)

vulnConfidentialityImpact : HIGH (string)

vulnIntegrityImpact : HIGH (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-427 (string)

description : CWE-427 Uncontrolled Search Path Element (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 4a9b9929-2450-4021-b7b9-469a0255b215 (string)

shortName : ESET (string)

dateUpdated : 2025-04-16T10:52:29.591Z (string)

}

references : [ »

0 : { »

url : https://support.eset.com/en/ca8810-dll-search-order-hijacking-vulnerability-in-eset-products-for-windows-fixed (string)

}

]

source : { »

advisory : CA8810 (string)

discovery : UNKNOWN (string)

}

title : DLL Search Order Hijacking in ESET products for Windows (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-04-07T16:33:40.931389Z (string)

id : CVE-2024-11859 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-07T16:35:08.284Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-11859", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-07T16:33:40.931389Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-07T16:35:01.576Z"}}], "cna": {"title": "DLL Search Order Hijacking in ESET products for Windows", "source": {"advisory": "CA8810", "discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-471", "descriptions": [{"lang": "en", "value": "CAPEC-471 Search Order Hijacking"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ESET, spol. s r.o.", "product": "ESET NOD32 Antivirus", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "18.0.12.0"}], "defaultStatus": "unaffected"}, {"vendor": "ESET, spol. s r.o.", "product": "ESET Internet Security", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "18.0.12.0"}], "defaultStatus": "unaffected"}, {"vendor": "ESET, spol. s r.o.", "product": "ESET Smart Security Premium", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "18.0.12.0"}], "defaultStatus": "unaffected"}, {"vendor": "ESET, spol. s r.o.", "product": "ESET Security Ultimate", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "18.0.12.0"}], "defaultStatus": "unaffected"}, {"vendor": "ESET, spol. s r.o.", "product": "ESET Endpoint Antivirus for Windows", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "12.0.2038.0"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "11.1.2053.2"}], "defaultStatus": "unaffected"}, {"vendor": "ESET, spol. s r.o.", "product": "ESET Endpoint Security for Windows", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "12.0.2038.0"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "11.1.2053.2"}], "defaultStatus": "unaffected"}, {"vendor": "ESET, spol. s r.o.", "product": "ESET Small Business Security", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "18.0.12.0"}], "defaultStatus": "unaffected"}, {"vendor": "ESET, spol. s r.o.", "product": "ESET Safe Server", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "18.0.12.0"}], "defaultStatus": "unaffected"}, {"vendor": "ESET, spol. s r.o.", "product": "ESET Server Security for Windows Server", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "11.1.12005.2"}], "defaultStatus": "unaffected"}, {"vendor": "ESET, spol. s r.o.", "product": "ESET Mail Security for Microsoft Exchange Server", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "11.1.10008.0"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "11.0.10008.0"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "10.1.10014.0"}], "defaultStatus": "unaffected"}, {"vendor": "ESET, spol. s r.o.", "product": "ESET Security for Microsoft SharePoint Server", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "11.1.15001.0"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "11.0.15004.0"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "10.0.15005.1"}], "defaultStatus": "unaffected"}], "datePublic": "2025-04-04T20:00:00.000Z", "references": [{"url": "https://support.eset.com/en/ca8810-dll-search-order-hijacking-vulnerability-in-eset-products-for-windows-fixed"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its code.", "supportingMedia": [{"type": "text/html", "value": "DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its code.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element"}]}], "providerMetadata": {"orgId": "4a9b9929-2450-4021-b7b9-469a0255b215", "shortName": "ESET", "dateUpdated": "2025-04-16T10:52:29.591Z"}}}, "cveMetadata": {"cveId": "CVE-2024-11859", "state": "PUBLISHED", "dateUpdated": "2025-04-16T10:52:29.591Z", "dateReserved": "2024-11-27T11:06:09.575Z", "assignerOrgId": "4a9b9929-2450-4021-b7b9-469a0255b215", "datePublished": "2025-04-07T08:08:22.127Z", "assignerShortName": "ESET"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-11859 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-04-07T16:33:40.931389Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-07T16:35:01.576Z (string)

}

]

cna : { »

title : DLL Search Order Hijacking in ESET products for Windows (string)

source : { »

advisory : CA8810 (string)

discovery : UNKNOWN (string)

}

impacts : [ »

0 : { »

capecId : CAPEC-471 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-471 Search Order Hijacking (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV4_0 : { »

Safety : NOT_DEFINED (string)

version : 4.0 (string)

Recovery : NOT_DEFINED (string)

baseScore : 8.4 (number)

Automatable : NOT_DEFINED (string)

attackVector : LOCAL (string)

baseSeverity : HIGH (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N (string)

providerUrgency : NOT_DEFINED (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

privilegesRequired : LOW (string)

subIntegrityImpact : NONE (string)

vulnIntegrityImpact : HIGH (string)

subAvailabilityImpact : NONE (string)

vulnAvailabilityImpact : NONE (string)

subConfidentialityImpact : NONE (string)

vulnConfidentialityImpact : HIGH (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : ESET, spol. s r.o. (string)

product : ESET NOD32 Antivirus (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 18.0.12.0 (string)

}

]

defaultStatus : unaffected (string)

}

1 : { »

vendor : ESET, spol. s r.o. (string)

product : ESET Internet Security (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 18.0.12.0 (string)

}

]

defaultStatus : unaffected (string)

}

2 : { »

vendor : ESET, spol. s r.o. (string)

product : ESET Smart Security Premium (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 18.0.12.0 (string)

}

]

defaultStatus : unaffected (string)

}

3 : { »

vendor : ESET, spol. s r.o. (string)

product : ESET Security Ultimate (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 18.0.12.0 (string)

}

]

defaultStatus : unaffected (string)

}

4 : { »

vendor : ESET, spol. s r.o. (string)

product : ESET Endpoint Antivirus for Windows (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 12.0.2038.0 (string)

}

1 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 11.1.2053.2 (string)

}

]

defaultStatus : unaffected (string)

}

5 : { »

vendor : ESET, spol. s r.o. (string)

product : ESET Endpoint Security for Windows (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 12.0.2038.0 (string)

}

1 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 11.1.2053.2 (string)

}

]

defaultStatus : unaffected (string)

}

6 : { »

vendor : ESET, spol. s r.o. (string)

product : ESET Small Business Security (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 18.0.12.0 (string)

}

]

defaultStatus : unaffected (string)

}

7 : { »

vendor : ESET, spol. s r.o. (string)

product : ESET Safe Server (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 18.0.12.0 (string)

}

]

defaultStatus : unaffected (string)

}

8 : { »

vendor : ESET, spol. s r.o. (string)

product : ESET Server Security for Windows Server (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 11.1.12005.2 (string)

}

]

defaultStatus : unaffected (string)

}

9 : { »

vendor : ESET, spol. s r.o. (string)

product : ESET Mail Security for Microsoft Exchange Server (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 11.1.10008.0 (string)

}

1 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 11.0.10008.0 (string)

}

2 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 10.1.10014.0 (string)

}

]

defaultStatus : unaffected (string)

}

10 : { »

vendor : ESET, spol. s r.o. (string)

product : ESET Security for Microsoft SharePoint Server (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 11.1.15001.0 (string)

}

1 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 11.0.15004.0 (string)

}

2 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 10.0.15005.1 (string)

}

]

defaultStatus : unaffected (string)

}

]

datePublic : 2025-04-04T20:00:00.000Z (string)

references : [ »

0 : { »

url : https://support.eset.com/en/ca8810-dll-search-order-hijacking-vulnerability-in-eset-products-for-windows-fixed (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its code. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its code. (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-427 (string)

description : CWE-427 Uncontrolled Search Path Element (string)

}

]

}

]

providerMetadata : { »

orgId : 4a9b9929-2450-4021-b7b9-469a0255b215 (string)

shortName : ESET (string)

dateUpdated : 2025-04-16T10:52:29.591Z (string)

}

cveMetadata : { »

cveId : CVE-2024-11859 (string)

state : PUBLISHED (string)

dateUpdated : 2025-04-16T10:52:29.591Z (string)

dateReserved : 2024-11-27T11:06:09.575Z (string)

assignerOrgId : 4a9b9929-2450-4021-b7b9-469a0255b215 (string)

datePublished : 2025-04-07T08:08:22.127Z (string)

assignerShortName : ESET (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"cveTags": [], "descriptions": [{"lang": "en", "value": "DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its code."}, {"lang": "es", "value": "La vulnerabilidad de secuestro del orden de b\u00fasqueda de DLL potencialmente permit\u00eda a un atacante con privilegios de administrador cargar una librer\u00eda de v\u00ednculo din\u00e1mico maliciosa y ejecutar su c\u00f3digo."}], "id": "CVE-2024-11859", "lastModified": "2025-04-16T11:15:41.373", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@eset.com", "type": "Secondary"}]}, "published": "2025-04-07T09:15:15.427", "references": [{"source": "security@eset.com", "url": "https://support.eset.com/en/ca8810-dll-search-order-hijacking-vulnerability-in-eset-products-for-windows-fixed"}], "sourceIdentifier": "security@eset.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "security@eset.com", "type": "Secondary"}]}

{

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its code. (string)

}

1 : { »

lang : es (string)

value : La vulnerabilidad de secuestro del orden de búsqueda de DLL potencialmente permitía a un atacante con privilegios de administrador cargar una librería de vínculo dinámico maliciosa y ejecutar su código. (string)

}

]

id : CVE-2024-11859 (string)

lastModified : 2025-04-16T11:15:41.373 (string)

metrics : { »

cvssMetricV40 : [ »

0 : { »

cvssData : { »

Automatable : NOT_DEFINED (string)

Recovery : NOT_DEFINED (string)

Safety : NOT_DEFINED (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

attackVector : LOCAL (string)

availabilityRequirement : NOT_DEFINED (string)

baseScore : 8.4 (number)

baseSeverity : HIGH (string)

confidentialityRequirement : NOT_DEFINED (string)

exploitMaturity : NOT_DEFINED (string)

integrityRequirement : NOT_DEFINED (string)

modifiedAttackComplexity : NOT_DEFINED (string)

modifiedAttackRequirements : NOT_DEFINED (string)

modifiedAttackVector : NOT_DEFINED (string)

modifiedPrivilegesRequired : NOT_DEFINED (string)

modifiedSubAvailabilityImpact : NOT_DEFINED (string)

modifiedSubConfidentialityImpact : NOT_DEFINED (string)

modifiedSubIntegrityImpact : NOT_DEFINED (string)

modifiedUserInteraction : NOT_DEFINED (string)

modifiedVulnAvailabilityImpact : NOT_DEFINED (string)

modifiedVulnConfidentialityImpact : NOT_DEFINED (string)

modifiedVulnIntegrityImpact : NOT_DEFINED (string)

privilegesRequired : LOW (string)

providerUrgency : NOT_DEFINED (string)

subAvailabilityImpact : NONE (string)

subConfidentialityImpact : NONE (string)

subIntegrityImpact : NONE (string)

userInteraction : NONE (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (string)

version : 4.0 (string)

vulnAvailabilityImpact : NONE (string)

vulnConfidentialityImpact : HIGH (string)

vulnIntegrityImpact : HIGH (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

}

source : security@eset.com (string)

type : Secondary (string)

}

]

}

published : 2025-04-07T09:15:15.427 (string)

references : [ »

0 : { »

source : security@eset.com (string)

url : https://support.eset.com/en/ca8810-dll-search-order-hijacking-vulnerability-in-eset-products-for-windows-fixed (string)

}

]

sourceIdentifier : security@eset.com (string)

vulnStatus : Awaiting Analysis (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-427 (string)

}

]

source : security@eset.com (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object