Asset
Monthly
SQL injection in the Tanium Asset module lets a high-privilege authenticated console user execute arbitrary SQL against the Asset data store, with the potential to read, modify, or destroy data the module manages (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The flaw is remotely reachable and requires no user interaction, but it is gated on two conditions: the optional Asset module must be deployed, and the attacker must already hold an elevated Tanium console session - a self-service or low-privilege account is insufficient. Affected builds are Asset before 1.33.326, before 1.36.174, and before 1.39.153; Tanium has released fixed versions and there is currently no public exploit identified at time of analysis, though the EPSS score is minimal and no CISA KEV listing applies.
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlying Asset database, carrying a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a privileged account on the Asset module with network access to its interface and no user interaction; unauthenticated or low-privilege users cannot reach the vulnerable query path, and because Tanium is typically an internally deployed enterprise platform, realistic abuse is concentrated among insiders or attackers who have already escalated to a privileged Asset role. Publicly available exploit code exists (a public gist is referenced), but the issue is not in CISA KEV, so there is no confirmation of active exploitation in the wild. Fixed versions are available from the vendor.
Tanium addressed a SQL injection vulnerability in Asset. [CVSS 6.3 MEDIUM]
Tanium addressed a SQL injection vulnerability in Asset. [CVSS 6.3 MEDIUM]
SQL injection in the Tanium Asset module lets a high-privilege authenticated console user execute arbitrary SQL against the Asset data store, with the potential to read, modify, or destroy data the module manages (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The flaw is remotely reachable and requires no user interaction, but it is gated on two conditions: the optional Asset module must be deployed, and the attacker must already hold an elevated Tanium console session - a self-service or low-privilege account is insufficient. Affected builds are Asset before 1.33.326, before 1.36.174, and before 1.39.153; Tanium has released fixed versions and there is currently no public exploit identified at time of analysis, though the EPSS score is minimal and no CISA KEV listing applies.
SQL injection in the Tanium Asset module lets an authenticated, high-privilege user read and modify data in the underlying Asset database, carrying a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a privileged account on the Asset module with network access to its interface and no user interaction; unauthenticated or low-privilege users cannot reach the vulnerable query path, and because Tanium is typically an internally deployed enterprise platform, realistic abuse is concentrated among insiders or attackers who have already escalated to a privileged Asset role. Publicly available exploit code exists (a public gist is referenced), but the issue is not in CISA KEV, so there is no confirmation of active exploitation in the wild. Fixed versions are available from the vendor.
Tanium addressed a SQL injection vulnerability in Asset. [CVSS 6.3 MEDIUM]
Tanium addressed a SQL injection vulnerability in Asset. [CVSS 6.3 MEDIUM]