CVE-2024-2451 - Vulnerability Details - OpenCVE

Improper fingerprint validation in the TeamViewer Client (Full & Host) prior Version 15.54 for Windows and macOS allows an attacker with administrative user rights to further elevate privileges via executable sideloading.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00019.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-27400	Improper fingerprint validation in the TeamViewer Client (Full & Host) prior Version 15.54 for Windows and macOS allows an attacker with administrative user rights to further elevate privileges via executable sideloading.

Fixes

Solution

Update to the latest version (15.54 or higher)

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2024-1004/

History

No history.

MITRE

Status: PUBLISHED

Assigner: TV

Published: 2024-05-28T14:27:25.918Z

Updated: 2024-08-01T19:11:53.533Z

Reserved: 2024-03-14T13:47:04.908Z

Link: CVE-2024-2451

Vulnrichment

Updated: 2024-08-01T19:11:53.533Z

NVD

Status : Awaiting Analysis

Published: 2024-05-28T15:15:09.163

Modified: 2024-11-21T09:09:46.897

Link: CVE-2024-2451

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-2451", "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6", "state": "PUBLISHED", "assignerShortName": "TV", "dateReserved": "2024-03-14T13:47:04.908Z", "datePublished": "2024-05-28T14:27:25.918Z", "dateUpdated": "2024-08-01T19:11:53.533Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Remote (Full Client)", "vendor": "TeamViewer", "versions": [{"lessThan": "15.54", "status": "affected", "version": "15.48", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Remote (Host)", "vendor": "TeamViewer", "versions": [{"lessThan": "15.54", "status": "affected", "version": "15.48", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["MacOS"], "product": "Remote (Full Client)", "vendor": "TeamViewer", "versions": [{"lessThan": "15.54", "status": "affected", "version": "15.51", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["MacOS"], "product": "Remote (Host)", "vendor": "TeamViewer", "versions": [{"lessThan": "15.54", "status": "affected", "version": "15.51", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Maximilian Barz"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper fingerprint validation in the TeamViewer Client (Full & Host) prior Version 15.54 for Windows and macOS allows an attacker with administrative user rights to further elevate privileges via executable sideloading."}], "value": "Improper fingerprint validation in the TeamViewer Client (Full & Host) prior Version 15.54 for Windows and macOS allows an attacker with administrative user rights to further elevate privileges via executable sideloading."}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-347", "description": "CWE-347 Improper Verification of Cryptographic Signature", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6", "shortName": "TV", "dateUpdated": "2024-05-28T14:27:25.918Z"}, "references": [{"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2024-1004/"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to the latest version (15.54 or higher)"}], "value": "Update to the latest version (15.54 or higher)"}], "source": {"discovery": "UNKNOWN"}, "title": "Improper fingerprint validation in the TeamViewer Client", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "teamviewer", "product": "remote", "cpes": ["cpe:2.3:a:teamviewer:remote:15.48:*:*:*:*:*:*:*", "cpe:2.3:a:teamviewer:remote:15.51:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "15.48", "status": "affected", "lessThan": "15.54", "versionType": "custom"}, {"version": "15.51", "status": "affected", "lessThan": "15.54", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-05-28T16:18:24.894767Z", "id": "CVE-2024-2451", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-24T17:59:43.200Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:11:53.533Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2024-1004/", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2024-1004/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:11:53.533Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-2451", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-28T16:18:24.894767Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:teamviewer:remote:15.48:*:*:*:*:*:*:*", "cpe:2.3:a:teamviewer:remote:15.51:*:*:*:*:*:*:*"], "vendor": "teamviewer", "product": "remote", "versions": [{"status": "affected", "version": "15.48", "lessThan": "15.54", "versionType": "custom"}, {"status": "affected", "version": "15.51", "lessThan": "15.54", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-28T16:22:48.370Z"}}], "cna": {"title": "Improper fingerprint validation in the TeamViewer Client", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Maximilian Barz"}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "TeamViewer", "product": "Remote (Full Client)", "versions": [{"status": "affected", "version": "15.48", "lessThan": "15.54", "versionType": "custom"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}, {"vendor": "TeamViewer", "product": "Remote (Host)", "versions": [{"status": "affected", "version": "15.48", "lessThan": "15.54", "versionType": "custom"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}, {"vendor": "TeamViewer", "product": "Remote (Full Client)", "versions": [{"status": "affected", "version": "15.51", "lessThan": "15.54", "versionType": "custom"}], "platforms": ["MacOS"], "defaultStatus": "unaffected"}, {"vendor": "TeamViewer", "product": "Remote (Host)", "versions": [{"status": "affected", "version": "15.51", "lessThan": "15.54", "versionType": "custom"}], "platforms": ["MacOS"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to the latest version (15.54 or higher)", "supportingMedia": [{"type": "text/html", "value": "Update to the latest version (15.54 or higher)", "base64": false}]}], "references": [{"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2024-1004/"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper fingerprint validation in the TeamViewer Client (Full & Host) prior Version 15.54 for Windows and macOS allows an attacker with administrative user rights to further elevate privileges via executable sideloading.", "supportingMedia": [{"type": "text/html", "value": "Improper fingerprint validation in the TeamViewer Client (Full & Host) prior Version 15.54 for Windows and macOS allows an attacker with administrative user rights to further elevate privileges via executable sideloading.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347 Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6", "shortName": "TV", "dateUpdated": "2024-05-28T14:27:25.918Z"}}}, "cveMetadata": {"cveId": "CVE-2024-2451", "state": "PUBLISHED", "dateUpdated": "2024-08-01T19:11:53.533Z", "dateReserved": "2024-03-14T13:47:04.908Z", "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6", "datePublished": "2024-05-28T14:27:25.918Z", "assignerShortName": "TV"}, "dataVersion": "5.1"}