Skip to main content

Advisor CVE-2024-26025

MEDIUM
Incorrect Default Permissions (CWE-276)
2024-08-14 secure@intel.com
Privilege Escalation Intel Advisor Oneapi Base Toolkit
5.4
CVSS 4.0 · Vendor: intel
Share

Severity by source

Vendor (intel) PRIMARY
5.4 MEDIUM
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (intel) · only source for this CVE.

CVSS VectorVendor: intel

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
A
Scope
X

Lifecycle Timeline

1
CVE Published
Aug 14, 2024 - 14:15 cve.org
MEDIUM 5.4

DescriptionCVE.org

Incorrect default permissions for some Intel(R) Advisor software before version 2024.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

AnalysisAI

Incorrect default permissions for some Intel(R) Advisor software before version 2024.1 may allow an authenticated user to potentially enable escalation of privilege via local access. Rated medium severity (CVSS 5.4). No vendor patch available.

Technical ContextAI

This vulnerability is classified as Incorrect Default Permissions (CWE-276), which allows attackers to access resources due to overly permissive default settings. Incorrect default permissions for some Intel(R) Advisor software before version 2024.1 may allow an authenticated user to potentially enable escalation of privilege via local access. Affected products include: Intel Advisor, Intel Oneapi Base Toolkit. Version information: version 2024.1.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Set restrictive default permissions, follow principle of least privilege, review defaults during deployment.

More in Advisor

View all
CVE-2023-1767 MEDIUM POC
5.4 Apr 20

The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. Rated mediu
CVE-2024-21772 HIGH
7.8 May 16

Uncontrolled search path in some Intel(R) Advisor software before version 2024.0 may allow an authenticated user to pote
CVE-2023-24592 HIGH
7.8 Nov 14

Path traversal in the some Intel(R) oneAPI Toolkits and Component software before version 2023.1 may allow authenticated
CVE-2023-22355 HIGH
7.8 May 10

Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.0.251 may

CVE-2022-21128 HIGH
7.8 May 12

Insufficient control flow management in the Intel(R) Advisor software before version 7.6.0.37 may allow an authenticated
CVE-2017-5682 HIGH
7.3 Feb 28

Intel PSET Application Install wrapper of Intel Parallel Studio XE, Intel System Studio, Intel VTune Amplifier, Intel In
CVE-2023-27383 MEDIUM
6.8 Nov 14

Protection mechanism failure in some Intel(R) oneAPI HPC Toolkit 2023.1 and Intel(R)MPI Library software before version

CVE-2024-39284 MEDIUM
5.4 Feb 12

Uncontrolled search path for some Intel(R) Advisor software before version 2024.2 may allow an authenticated user to pot
CVE-2025-20079 MEDIUM
5.4 May 13

Uncontrolled search path for some Intel(R) Advisor software may allow an authenticated user to potentially enable escala

Same weakness CWE-276 – Incorrect Default Permissions

View all
CVE-2013-0632 CRITICAL POC
9.8
CVE-2017-11610 HIGH POC
8.8
CVE-2022-22948 MEDIUM POC
6.5
CVE-2017-8625 HIGH POC
8.8
CVE-2016-5425 HIGH POC
7.8
CVE-2024-55215 CRITICAL POC
9.8
CVE-2024-57604 CRITICAL POC
9.8
CVE-2025-60262 CRITICAL POC
9.8

Same technique Privilege Escalation

View all
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2017-5689 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2016-10372 CRITICAL POC
9.8
CVE-2014-9583 CRITICAL POC
10.0
CVE-2012-0297 CRITICAL POC
10.0

Share

CVE-2024-26025 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy