CVE-2024-7400 - Vulnerability Details

Vendors	Products
Eset	Endpoint Antivirus Endpoint Security File Security Internet Security Mail Security Nod32 Antivirus Safe Server Security Security Ultimate Server Security Small Business Security Smart Security

Link	Providers
https://support.eset.com/en/ca8726-local-privilege-escalation-fixed-for-vulnerability-during-detected-file-removal-in-eset-products-for-windows

Type	Values Removed	Values Added
First Time appeared		Eset Eset endpoint Antivirus Eset endpoint Security Eset file Security Eset internet Security Eset mail Security Eset nod32 Antivirus Eset safe Server Eset security Eset security Ultimate Eset server Security Eset small Business Security Eset smart Security
CPEs		cpe:2.3:a:eset:endpoint_antivirus:::::::: cpe:2.3:a:eset:endpoint_security:-:::::windows:: cpe:2.3:a:eset:file_security:-:::::azure:: cpe:2.3:a:eset:internet_security:::::::: cpe:2.3:a:eset:mail_security:-:::::domino:: cpe:2.3:a:eset:mail_security:-:::::exchange_server:: cpe:2.3:a:eset:nod32_antivirus:::::::: cpe:2.3:a:eset:safe_server:-:::::::* cpe:2.3:a:eset:security:-:::::sharepoint_server:: cpe:2.3:a:eset:security_ultimate:::::::: cpe:2.3:a:eset:server_security:-:::::windows_server:: cpe:2.3:a:eset:small_business_security:::::::: cpe:2.3:a:eset:smart_security:-::::premium:::
Vendors & Products		Eset Eset endpoint Antivirus Eset endpoint Security Eset file Security Eset internet Security Eset mail Security Eset nod32 Antivirus Eset safe Server Eset security Eset security Ultimate Eset server Security Eset small Business Security Eset smart Security
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		The vulnerability potentially allowed an attacker to misuse ESET’s file operations during the removal of a detected file on the Windows operating system to delete files without having proper permissions to do so.
Title		Local privilege escalation in ESET products for Windows
Weaknesses		CWE-1386
References		https://support.eset.com/en/ca8726-local-privilege-escalation-fixed-for-vulnerability-during-detected-file-removal-in-eset-products-for-windows
Metrics		cvssV4_0 `{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-7400", "assignerOrgId": "4a9b9929-2450-4021-b7b9-469a0255b215", "state": "PUBLISHED", "assignerShortName": "ESET", "dateReserved": "2024-08-02T07:12:41.358Z", "datePublished": "2024-09-27T07:02:28.931Z", "dateUpdated": "2024-09-27T18:54:39.099Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Cleaner module"], "product": "ESET NOD32 Antivirus", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "1250", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["Cleaner module"], "product": "ESET Internet Security", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "1250", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["Cleaner module"], "product": "ESET Smart Security Premium", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "1250", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["Cleaner module"], "product": "ESET Security Ultimate", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "1250", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["Cleaner module"], "product": "ESET Small Business Security", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "1250", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["Cleaner module"], "product": "ESET Safe Server", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "1250", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["Cleaner module"], "product": "ESET Endpoint Antivirus", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "1250", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["Cleaner module"], "product": "ESET Endpoint Security for Windows", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "1250", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["Cleaner module"], "product": "ESET Server Security for Windows Server", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "1250", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["Cleaner module"], "product": "ESET Mail Security for Microsoft Exchange Server", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "1250", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["Cleaner module"], "product": "ESET Mail Security for IBM Domino", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "1250", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["Cleaner module"], "product": "ESET Security for Microsoft SharePoint Server", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "1250", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["Cleaner module"], "product": "ESET File Security for Microsoft Azure", "vendor": "ESET, spol. s r.o.", "versions": [{"lessThanOrEqual": "1250", "status": "affected", "version": "0", "versionType": "custom"}]}], "datePublic": "2024-09-20T10:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">The vulnerability potentially allowed an attacker to misuse ESET\u2019s file operations during the removal of a detected file on the Windows operating system to delete files without having proper permissions to do so.</span>"}], "value": "The vulnerability potentially allowed an attacker to misuse ESET\u2019s file operations during the removal of a detected file on the Windows operating system to delete files without having proper permissions to do so."}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 8.5, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1386", "description": "CWE-1386 Insecure Operation on Windows Junction / Mount Point", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4a9b9929-2450-4021-b7b9-469a0255b215", "shortName": "ESET", "dateUpdated": "2024-09-27T07:02:28.931Z"}, "references": [{"url": "https://support.eset.com/en/ca8726-local-privilege-escalation-fixed-for-vulnerability-during-detected-file-removal-in-eset-products-for-windows"}], "source": {"advisory": "ca8726", "discovery": "UNKNOWN"}, "title": "Local privilege escalation in ESET products for Windows", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "eset", "product": "mail_security", "cpes": ["cpe:2.3:a:eset:security:-:*:*:*:*:sharepoint_server:*:*", "cpe:2.3:a:eset:safe_server:-:*:*:*:*:*:*:*", "cpe:2.3:a:eset:security_ultimate:*:*:*:*:*:*:*:*", "cpe:2.3:a:eset:server_security:-:*:*:*:*:windows_server:*:*", "cpe:2.3:a:eset:small_business_security:*:*:*:*:*:*:*:*", "cpe:2.3:a:eset:smart_security:-:*:*:*:premium:*:*:*", "cpe:2.3:a:eset:nod32_antivirus:*:*:*:*:*:*:*:*", "cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:*:*:*", "cpe:2.3:a:eset:endpoint_security:-:*:*:*:*:windows:*:*", "cpe:2.3:a:eset:file_security:-:*:*:*:*:azure:*:*", "cpe:2.3:a:eset:internet_security:*:*:*:*:*:*:*:*", "cpe:2.3:a:eset:mail_security:-:*:*:*:*:domino:*:*", "cpe:2.3:a:eset:mail_security:-:*:*:*:*:exchange_server:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1250", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-27T17:57:43.358687Z", "id": "CVE-2024-7400", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-27T18:54:39.099Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-7400 (string)

assignerOrgId : 4a9b9929-2450-4021-b7b9-469a0255b215 (string)

state : PUBLISHED (string)

assignerShortName : ESET (string)

dateReserved : 2024-08-02T07:12:41.358Z (string)

datePublished : 2024-09-27T07:02:28.931Z (string)

dateUpdated : 2024-09-27T18:54:39.099Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET NOD32 Antivirus (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 1250 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

1 : { »

defaultStatus : unaffected (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET Internet Security (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 1250 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

2 : { »

defaultStatus : unaffected (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET Smart Security Premium (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 1250 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

3 : { »

defaultStatus : unaffected (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET Security Ultimate (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 1250 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

4 : { »

defaultStatus : unaffected (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET Small Business Security (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 1250 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

5 : { »

defaultStatus : unaffected (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET Safe Server (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 1250 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

6 : { »

defaultStatus : unaffected (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET Endpoint Antivirus (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 1250 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

7 : { »

defaultStatus : unaffected (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET Endpoint Security for Windows (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 1250 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

8 : { »

defaultStatus : unaffected (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET Server Security for Windows Server (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 1250 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

9 : { »

defaultStatus : unaffected (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET Mail Security for Microsoft Exchange Server (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 1250 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

10 : { »

defaultStatus : unaffected (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET Mail Security for IBM Domino (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 1250 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

11 : { »

defaultStatus : unaffected (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET Security for Microsoft SharePoint Server (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 1250 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

12 : { »

defaultStatus : unaffected (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET File Security for Microsoft Azure (string)

vendor : ESET, spol. s r.o. (string)

versions : [ »

0 : { »

lessThanOrEqual : 1250 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

]

datePublic : 2024-09-20T10:00:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : <span style="background-color: rgb(255, 255, 255);">The vulnerability potentially allowed an attacker to misuse ESET’s file operations during the removal of a detected file on the Windows operating system to delete files without having proper permissions to do so.</span> (string)

}

]

value : The vulnerability potentially allowed an attacker to misuse ESET’s file operations during the removal of a detected file on the Windows operating system to delete files without having proper permissions to do so. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-233 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-233 Privilege Escalation (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV4_0 : { »

Automatable : NOT_DEFINED (string)

Recovery : NOT_DEFINED (string)

Safety : NOT_DEFINED (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

attackVector : LOCAL (string)

baseScore : 8.5 (number)

baseSeverity : HIGH (string)

privilegesRequired : LOW (string)

providerUrgency : NOT_DEFINED (string)

subAvailabilityImpact : NONE (string)

subConfidentialityImpact : NONE (string)

subIntegrityImpact : NONE (string)

userInteraction : NONE (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (string)

version : 4.0 (string)

vulnAvailabilityImpact : HIGH (string)

vulnConfidentialityImpact : HIGH (string)

vulnIntegrityImpact : HIGH (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-1386 (string)

description : CWE-1386 Insecure Operation on Windows Junction / Mount Point (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 4a9b9929-2450-4021-b7b9-469a0255b215 (string)

shortName : ESET (string)

dateUpdated : 2024-09-27T07:02:28.931Z (string)

}

references : [ »

0 : { »

url : https://support.eset.com/en/ca8726-local-privilege-escalation-fixed-for-vulnerability-during-detected-file-removal-in-eset-products-for-windows (string)

}

]

source : { »

advisory : ca8726 (string)

discovery : UNKNOWN (string)

}

title : Local privilege escalation in ESET products for Windows (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

affected : [ »

0 : { »

vendor : eset (string)

product : mail_security (string)

cpes : [ »

0 : cpe:2.3:a:eset:security:-:*:*:*:*:sharepoint_server:*:* (string)

1 : cpe:2.3:a:eset:safe_server:-:*:*:*:*:*:*:* (string)

2 : cpe:2.3:a:eset:security_ultimate:*:*:*:*:*:*:*:* (string)

3 : cpe:2.3:a:eset:server_security:-:*:*:*:*:windows_server:*:* (string)

4 : cpe:2.3:a:eset:small_business_security:*:*:*:*:*:*:*:* (string)

5 : cpe:2.3:a:eset:smart_security:-:*:*:*:premium:*:*:* (string)

6 : cpe:2.3:a:eset:nod32_antivirus:*:*:*:*:*:*:*:* (string)

7 : cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:*:*:* (string)

8 : cpe:2.3:a:eset:endpoint_security:-:*:*:*:*:windows:*:* (string)

9 : cpe:2.3:a:eset:file_security:-:*:*:*:*:azure:*:* (string)

10 : cpe:2.3:a:eset:internet_security:*:*:*:*:*:*:*:* (string)

11 : cpe:2.3:a:eset:mail_security:-:*:*:*:*:domino:*:* (string)

12 : cpe:2.3:a:eset:mail_security:-:*:*:*:*:exchange_server:*:* (string)

]

defaultStatus : unaffected (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThanOrEqual : 1250 (string)

versionType : custom (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-09-27T17:57:43.358687Z (string)

id : CVE-2024-7400 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-27T18:54:39.099Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-7400", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-27T17:57:43.358687Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:eset:security:-:*:*:*:*:sharepoint_server:*:*", "cpe:2.3:a:eset:safe_server:-:*:*:*:*:*:*:*", "cpe:2.3:a:eset:security_ultimate:*:*:*:*:*:*:*:*", "cpe:2.3:a:eset:server_security:-:*:*:*:*:windows_server:*:*", "cpe:2.3:a:eset:small_business_security:*:*:*:*:*:*:*:*", "cpe:2.3:a:eset:smart_security:-:*:*:*:premium:*:*:*", "cpe:2.3:a:eset:nod32_antivirus:*:*:*:*:*:*:*:*", "cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:*:*:*", "cpe:2.3:a:eset:endpoint_security:-:*:*:*:*:windows:*:*", "cpe:2.3:a:eset:file_security:-:*:*:*:*:azure:*:*", "cpe:2.3:a:eset:internet_security:*:*:*:*:*:*:*:*", "cpe:2.3:a:eset:mail_security:-:*:*:*:*:domino:*:*", "cpe:2.3:a:eset:mail_security:-:*:*:*:*:exchange_server:*:*"], "vendor": "eset", "product": "mail_security", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1250"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-27T18:54:31.575Z"}}], "cna": {"title": "Local privilege escalation in ESET products for Windows", "source": {"advisory": "ca8726", "discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ESET, spol. s r.o.", "modules": ["Cleaner module"], "product": "ESET NOD32 Antivirus", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1250"}], "defaultStatus": "unaffected"}, {"vendor": "ESET, spol. s r.o.", "modules": ["Cleaner module"], "product": "ESET Internet Security", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1250"}], "defaultStatus": "unaffected"}, {"vendor": "ESET, spol. s r.o.", "modules": ["Cleaner module"], "product": "ESET Smart Security Premium", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1250"}], "defaultStatus": "unaffected"}, {"vendor": "ESET, spol. s r.o.", "modules": ["Cleaner module"], "product": "ESET Security Ultimate", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1250"}], "defaultStatus": "unaffected"}, {"vendor": "ESET, spol. s r.o.", "modules": ["Cleaner module"], "product": "ESET Small Business Security", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1250"}], "defaultStatus": "unaffected"}, {"vendor": "ESET, spol. s r.o.", "modules": ["Cleaner module"], "product": "ESET Safe Server", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1250"}], "defaultStatus": "unaffected"}, {"vendor": "ESET, spol. s r.o.", "modules": ["Cleaner module"], "product": "ESET Endpoint Antivirus", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1250"}], "defaultStatus": "unaffected"}, {"vendor": "ESET, spol. s r.o.", "modules": ["Cleaner module"], "product": "ESET Endpoint Security for Windows", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1250"}], "defaultStatus": "unaffected"}, {"vendor": "ESET, spol. s r.o.", "modules": ["Cleaner module"], "product": "ESET Server Security for Windows Server", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1250"}], "defaultStatus": "unaffected"}, {"vendor": "ESET, spol. s r.o.", "modules": ["Cleaner module"], "product": "ESET Mail Security for Microsoft Exchange Server", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1250"}], "defaultStatus": "unaffected"}, {"vendor": "ESET, spol. s r.o.", "modules": ["Cleaner module"], "product": "ESET Mail Security for IBM Domino", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1250"}], "defaultStatus": "unaffected"}, {"vendor": "ESET, spol. s r.o.", "modules": ["Cleaner module"], "product": "ESET Security for Microsoft SharePoint Server", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1250"}], "defaultStatus": "unaffected"}, {"vendor": "ESET, spol. s r.o.", "modules": ["Cleaner module"], "product": "ESET File Security for Microsoft Azure", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1250"}], "defaultStatus": "unaffected"}], "datePublic": "2024-09-20T10:00:00.000Z", "references": [{"url": "https://support.eset.com/en/ca8726-local-privilege-escalation-fixed-for-vulnerability-during-detected-file-removal-in-eset-products-for-windows"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The vulnerability potentially allowed an attacker to misuse ESET\u2019s file operations during the removal of a detected file on the Windows operating system to delete files without having proper permissions to do so.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">The vulnerability potentially allowed an attacker to misuse ESET\u2019s file operations during the removal of a detected file on the Windows operating system to delete files without having proper permissions to do so.</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1386", "description": "CWE-1386 Insecure Operation on Windows Junction / Mount Point"}]}], "providerMetadata": {"orgId": "4a9b9929-2450-4021-b7b9-469a0255b215", "shortName": "ESET", "dateUpdated": "2024-09-27T07:02:28.931Z"}}}, "cveMetadata": {"cveId": "CVE-2024-7400", "state": "PUBLISHED", "dateUpdated": "2024-09-27T18:54:39.099Z", "dateReserved": "2024-08-02T07:12:41.358Z", "assignerOrgId": "4a9b9929-2450-4021-b7b9-469a0255b215", "datePublished": "2024-09-27T07:02:28.931Z", "assignerShortName": "ESET"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-7400 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-09-27T17:57:43.358687Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:eset:security:-:*:*:*:*:sharepoint_server:*:* (string)

1 : cpe:2.3:a:eset:safe_server:-:*:*:*:*:*:*:* (string)

2 : cpe:2.3:a:eset:security_ultimate:*:*:*:*:*:*:*:* (string)

3 : cpe:2.3:a:eset:server_security:-:*:*:*:*:windows_server:*:* (string)

4 : cpe:2.3:a:eset:small_business_security:*:*:*:*:*:*:*:* (string)

5 : cpe:2.3:a:eset:smart_security:-:*:*:*:premium:*:*:* (string)

6 : cpe:2.3:a:eset:nod32_antivirus:*:*:*:*:*:*:*:* (string)

7 : cpe:2.3:a:eset:endpoint_antivirus:*:*:*:*:*:*:*:* (string)

8 : cpe:2.3:a:eset:endpoint_security:-:*:*:*:*:windows:*:* (string)

9 : cpe:2.3:a:eset:file_security:-:*:*:*:*:azure:*:* (string)

10 : cpe:2.3:a:eset:internet_security:*:*:*:*:*:*:*:* (string)

11 : cpe:2.3:a:eset:mail_security:-:*:*:*:*:domino:*:* (string)

12 : cpe:2.3:a:eset:mail_security:-:*:*:*:*:exchange_server:*:* (string)

]

vendor : eset (string)

product : mail_security (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 1250 (string)

}

]

defaultStatus : unaffected (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-27T18:54:31.575Z (string)

}

]

cna : { »

title : Local privilege escalation in ESET products for Windows (string)

source : { »

advisory : ca8726 (string)

discovery : UNKNOWN (string)

}

impacts : [ »

0 : { »

capecId : CAPEC-233 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-233 Privilege Escalation (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV4_0 : { »

Safety : NOT_DEFINED (string)

version : 4.0 (string)

Recovery : NOT_DEFINED (string)

baseScore : 8.5 (number)

Automatable : NOT_DEFINED (string)

attackVector : LOCAL (string)

baseSeverity : HIGH (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (string)

providerUrgency : NOT_DEFINED (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

privilegesRequired : LOW (string)

subIntegrityImpact : NONE (string)

vulnIntegrityImpact : HIGH (string)

subAvailabilityImpact : NONE (string)

vulnAvailabilityImpact : HIGH (string)

subConfidentialityImpact : NONE (string)

vulnConfidentialityImpact : HIGH (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : ESET, spol. s r.o. (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET NOD32 Antivirus (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 1250 (string)

}

]

defaultStatus : unaffected (string)

}

1 : { »

vendor : ESET, spol. s r.o. (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET Internet Security (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 1250 (string)

}

]

defaultStatus : unaffected (string)

}

2 : { »

vendor : ESET, spol. s r.o. (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET Smart Security Premium (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 1250 (string)

}

]

defaultStatus : unaffected (string)

}

3 : { »

vendor : ESET, spol. s r.o. (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET Security Ultimate (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 1250 (string)

}

]

defaultStatus : unaffected (string)

}

4 : { »

vendor : ESET, spol. s r.o. (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET Small Business Security (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 1250 (string)

}

]

defaultStatus : unaffected (string)

}

5 : { »

vendor : ESET, spol. s r.o. (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET Safe Server (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 1250 (string)

}

]

defaultStatus : unaffected (string)

}

6 : { »

vendor : ESET, spol. s r.o. (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET Endpoint Antivirus (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 1250 (string)

}

]

defaultStatus : unaffected (string)

}

7 : { »

vendor : ESET, spol. s r.o. (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET Endpoint Security for Windows (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 1250 (string)

}

]

defaultStatus : unaffected (string)

}

8 : { »

vendor : ESET, spol. s r.o. (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET Server Security for Windows Server (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 1250 (string)

}

]

defaultStatus : unaffected (string)

}

9 : { »

vendor : ESET, spol. s r.o. (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET Mail Security for Microsoft Exchange Server (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 1250 (string)

}

]

defaultStatus : unaffected (string)

}

10 : { »

vendor : ESET, spol. s r.o. (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET Mail Security for IBM Domino (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 1250 (string)

}

]

defaultStatus : unaffected (string)

}

11 : { »

vendor : ESET, spol. s r.o. (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET Security for Microsoft SharePoint Server (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 1250 (string)

}

]

defaultStatus : unaffected (string)

}

12 : { »

vendor : ESET, spol. s r.o. (string)

modules : [ »

0 : Cleaner module (string)

]

product : ESET File Security for Microsoft Azure (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

versionType : custom (string)

lessThanOrEqual : 1250 (string)

}

]

defaultStatus : unaffected (string)

}

]

datePublic : 2024-09-20T10:00:00.000Z (string)

references : [ »

0 : { »

url : https://support.eset.com/en/ca8726-local-privilege-escalation-fixed-for-vulnerability-during-detected-file-removal-in-eset-products-for-windows (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : The vulnerability potentially allowed an attacker to misuse ESET’s file operations during the removal of a detected file on the Windows operating system to delete files without having proper permissions to do so. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : <span style="background-color: rgb(255, 255, 255);">The vulnerability potentially allowed an attacker to misuse ESET’s file operations during the removal of a detected file on the Windows operating system to delete files without having proper permissions to do so.</span> (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-1386 (string)

description : CWE-1386 Insecure Operation on Windows Junction / Mount Point (string)

}

]

}

]

providerMetadata : { »

orgId : 4a9b9929-2450-4021-b7b9-469a0255b215 (string)

shortName : ESET (string)

dateUpdated : 2024-09-27T07:02:28.931Z (string)

}

cveMetadata : { »

cveId : CVE-2024-7400 (string)

state : PUBLISHED (string)

dateUpdated : 2024-09-27T18:54:39.099Z (string)

dateReserved : 2024-08-02T07:12:41.358Z (string)

assignerOrgId : 4a9b9929-2450-4021-b7b9-469a0255b215 (string)

datePublished : 2024-09-27T07:02:28.931Z (string)

assignerShortName : ESET (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The vulnerability potentially allowed an attacker to misuse ESET\u2019s file operations during the removal of a detected file on the Windows operating system to delete files without having proper permissions to do so."}, {"lang": "es", "value": "La vulnerabilidad potencialmente permiti\u00f3 a un atacante hacer un mal uso de las operaciones de archivos de ESET durante la eliminaci\u00f3n de un archivo detectado en el sistema operativo Windows para eliminar archivos sin tener los permisos adecuados para hacerlo."}], "id": "CVE-2024-7400", "lastModified": "2024-09-30T12:46:20.237", "metrics": {"cvssMetricV40": [{"cvssData": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "automatable": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "recovery": "NOT_DEFINED", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "subsequentSystemIntegrity": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnerabilityResponseEffort": "NOT_DEFINED", "vulnerableSystemAvailability": "HIGH", "vulnerableSystemConfidentiality": "HIGH", "vulnerableSystemIntegrity": "HIGH"}, "source": "security@eset.com", "type": "Secondary"}]}, "published": "2024-09-27T07:15:03.387", "references": [{"source": "security@eset.com", "url": "https://support.eset.com/en/ca8726-local-privilege-escalation-fixed-for-vulnerability-during-detected-file-removal-in-eset-products-for-windows"}], "sourceIdentifier": "security@eset.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1386"}], "source": "security@eset.com", "type": "Secondary"}]}

{

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : The vulnerability potentially allowed an attacker to misuse ESET’s file operations during the removal of a detected file on the Windows operating system to delete files without having proper permissions to do so. (string)

}

1 : { »

lang : es (string)

value : La vulnerabilidad potencialmente permitió a un atacante hacer un mal uso de las operaciones de archivos de ESET durante la eliminación de un archivo detectado en el sistema operativo Windows para eliminar archivos sin tener los permisos adecuados para hacerlo. (string)

}

]

id : CVE-2024-7400 (string)

lastModified : 2024-09-30T12:46:20.237 (string)

metrics : { »

cvssMetricV40 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackRequirements : NONE (string)

attackVector : LOCAL (string)

automatable : NOT_DEFINED (string)

availabilityRequirements : NOT_DEFINED (string)

baseScore : 8.5 (number)

baseSeverity : HIGH (string)

confidentialityRequirements : NOT_DEFINED (string)

exploitMaturity : NOT_DEFINED (string)

integrityRequirements : NOT_DEFINED (string)

modifiedAttackComplexity : NOT_DEFINED (string)

modifiedAttackRequirements : NOT_DEFINED (string)

modifiedAttackVector : NOT_DEFINED (string)

modifiedPrivilegesRequired : NOT_DEFINED (string)

modifiedSubsequentSystemAvailability : NOT_DEFINED (string)

modifiedSubsequentSystemConfidentiality : NOT_DEFINED (string)

modifiedSubsequentSystemIntegrity : NOT_DEFINED (string)

modifiedUserInteraction : NOT_DEFINED (string)

modifiedVulnerableSystemAvailability : NOT_DEFINED (string)

modifiedVulnerableSystemConfidentiality : NOT_DEFINED (string)

modifiedVulnerableSystemIntegrity : NOT_DEFINED (string)

privilegesRequired : LOW (string)

providerUrgency : NOT_DEFINED (string)

recovery : NOT_DEFINED (string)

safety : NOT_DEFINED (string)

subsequentSystemAvailability : NONE (string)

subsequentSystemConfidentiality : NONE (string)

subsequentSystemIntegrity : NONE (string)

userInteraction : NONE (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (string)

version : 4.0 (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

vulnerableSystemAvailability : HIGH (string)

vulnerableSystemConfidentiality : HIGH (string)

vulnerableSystemIntegrity : HIGH (string)

}

source : security@eset.com (string)

type : Secondary (string)

}

]

}

published : 2024-09-27T07:15:03.387 (string)

references : [ »

0 : { »

source : security@eset.com (string)

url : https://support.eset.com/en/ca8726-local-privilege-escalation-fixed-for-vulnerability-during-detected-file-removal-in-eset-products-for-windows (string)

}

]

sourceIdentifier : security@eset.com (string)

vulnStatus : Awaiting Analysis (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-1386 (string)

}

]

source : security@eset.com (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object