惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

月光博客
月光博客
Martin Fowler
Martin Fowler
cs.CL updates on arXiv.org
cs.CL updates on arXiv.org
Stack Overflow Blog
Stack Overflow Blog
C
Check Point Blog
阮一峰的网络日志
阮一峰的网络日志
奇客Solidot–传递最新科技情报
奇客Solidot–传递最新科技情报
B
Blog
O
OpenAI News
云风的 BLOG
云风的 BLOG
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
L
LangChain Blog
V
Vulnerabilities – Threatpost
P
Privacy & Cybersecurity Law Blog
Microsoft Azure Blog
Microsoft Azure Blog
H
Help Net Security
博
博客园 - 三生石上(FineUI控件)
C
Cyber Attacks, Cyber Crime and Cyber Security
N
News | PayPal Newsroom
The Register - Security
The Register - Security
Cyber Security Advisories - MS-ISAC
Cyber Security Advisories - MS-ISAC
T
Threat Research - Cisco Blogs
C
Cisco Blogs
www.infosecurity-magazine.com
www.infosecurity-magazine.com
Vercel News
Vercel News
宝玉的分享
宝玉的分享
T
Tailwind CSS Blog
H
Hackread – Cybersecurity News, Data Breaches, AI and More
Attack and Defense Labs
Attack and Defense Labs
人人都是产品经理
人人都是产品经理
S
Security Affairs
爱范儿
爱范儿
Engineering at Meta
Engineering at Meta
T
Tor Project blog
大猫的无限游戏
大猫的无限游戏
L
Lohrmann on Cybersecurity
aimingoo的专栏
aimingoo的专栏
K
KPMG report finds enterprise disconnect between AI and its ROI | CIO
博
博客园 - 【当耐特】
V
V2EX
V
Visual Studio Blog
The GitHub Blog
The GitHub Blog
雷峰网
雷峰网
WordPress大学
WordPress大学
Exploit-DB.com RSS Feed
Exploit-DB.com RSS Feed
L
LINUX DO - 最新话题
让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com
Schneier on Security
Schneier on Security
小众软件
小众软件
PCI Perspectives
PCI Perspectives

Okta Trust

Okta Verify Desktop MFA for Windows Passwordless Login CVE-2024-9191 Okta Verify for iOS ContextExtension CVE-2024-10327 Okta Classic Application Sign-On Policy Bypass Okta Browser Plugin Reflected Cross-Site Scripting CVE-2024-0981 Okta Advanced Server Access Client CVE-2023-0093 Okta Access Gateway Advisory for CVE-2022-3602 and CVE-2022-3786 Okta Active Directory Agent CVE-2022-1697 Okta Advanced Server Access Client CVE-2022-1030 Okta Advanced Server Access Client CVE-2022-24295 Okta RADIUS Server Agent CVE-2021-45105 Okta On-Prem MFA Agent CVE-2021-45046 Okta RADIUS Server Agent CVE-2021-45046 Okta On-Prem MFA Agent CVE-2021-44228 Okta RADIUS Server Agent CVE-2021-44228 Okta On-Prem MFA Agent CVE-2021-45105 Okta Verify for Windows Privilege Escalation CVE-2024-7061 Okta LDAP Agent CVE-2023-0392 - Sep 19, 2023 Okta AD/LDAP Delegated Authentication - Username Above 52 Characters Security Advisory Okta Access Gateway CVE-2021-28113 - Apr 2, 2021
Okta Verify for Windows Auto-update Arbitrary Code Execution CVE-2024-0980
Okta, Inc. · 2024-03-26 · via Okta Trust

Description

The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could be used to execute arbitrary code.

Affected product and versions

Customers using Okta Verify for Windows prior to version 4.10.7 that have currently installed or previously had installed versions prior to 4.10.7 of Okta Verify for Windows.

Note: Customers using Okta Verify on platforms other than Windows are not affected.

Resolution

The vulnerability is fixed in Okta Verify for Windows version 4.10.7. To remediate this vulnerability, upgrade to 4.10.7 or greater.

CVE details

CVE ID

CVE-2024-0980

Published Date

2024-03-26

Vulnerability Type

Improper Limitation of a Pathname to a Restricted Directory, Uncontrolled Search Path or Element

CWE

CWE–22, CWE-427

CVSS v3

Score:7.1

Vector string:CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Acknowledgements

Okta would like to thank Ryan Wincey of Securifera, Inc. for providing information in addressing this vulnerability.

References

Deploy Okta Verify to Windows devices

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。