Provision
Monthly
Denial of service in Tanium Provision allows unauthenticated remote attackers to degrade availability of affected Provision instances - 1.17 before 1.17.150, 1.23 before 1.23.161 and 1.24 before 1.24.199 - with CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so confidentiality and integrity are unaffected. Tanium has released fixed builds (1.17.150, 1.23.161 and 1.24.199); no public exploit was identified at time of analysis and the issue is not in CISA KEV. Priority is this_week: the practical risk hinges on whether the Provision service is reachable from untrusted networks or confined to a management segment.
Authenticated SQL injection in Tanium Provision can expose or modify data and cause limited service disruption for a low-privileged user who already holds a valid session. Provision 1.17 before 1.17.150, 1.23 before 1.23.161, and 1.24 before 1.24.199 are affected, and Tanium has released fixed builds for each branch. The vendor rates the issue CVSS 6.3 with PR:L and UI:N, the vulnerable endpoint or parameter is not identified in the available sources, and no public exploit was identified at time of analysis.
Denial of service in Tanium Provision allows unauthenticated remote attackers to degrade availability of affected Provision instances - 1.17 before 1.17.150, 1.23 before 1.23.161 and 1.24 before 1.24.199 - with CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so confidentiality and integrity are unaffected. Tanium has released fixed builds (1.17.150, 1.23.161 and 1.24.199); no public exploit was identified at time of analysis and the issue is not in CISA KEV. Priority is this_week: the practical risk hinges on whether the Provision service is reachable from untrusted networks or confined to a management segment.
Authenticated SQL injection in Tanium Provision can expose or modify data and cause limited service disruption for a low-privileged user who already holds a valid session. Provision 1.17 before 1.17.150, 1.23 before 1.23.161, and 1.24 before 1.24.199 are affected, and Tanium has released fixed builds for each branch. The vendor rates the issue CVSS 6.3 with PR:L and UI:N, the vulnerable endpoint or parameter is not identified in the available sources, and no public exploit was identified at time of analysis.