CVE-2024-14047

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-14047", "assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a", "state": "PUBLISHED", "assignerShortName": "elastic", "dateReserved": "2026-08-31T09:06:33.044Z", "datePublished": "2026-09-01T13:59:19.534Z", "dateUpdated": "2026-09-01T15:47:36.179Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Elastic Security", "vendor": "Elastic", "versions": [{"status": "affected", "versionType": "semver", "version": "7.6.0", "lessThanOrEqual": "8.12.2"}]}], "descriptions": [{"lang": "en", "value": "A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation to write to or delete arbitrary files. Successful exploitation could result in a denial of service.", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation to write to or delete arbitrary files. Successful exploitation could result in a denial of service.</p>"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a", "shortName": "elastic", "dateUpdated": "2026-09-01T13:59:19.534Z"}, "references": [{"url": "https://discuss.elastic.co/t/winlogbeat-8-13-0-security-update-esa-2024-49/390044"}], "source": {"discovery": "Elastic"}, "title": "Improper Link Resolution Before File Access ('Link Following') in Winlogbeat Leading to Arbitrary File Write and Denial of Service", "x_generator": {"engine": "Elastic CVE Publisher 1.0.0"}, "impacts": [{"capecId": "CAPEC-132", "descriptions": [{"lang": "en", "value": "CAPEC-132 Symlink Attack"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-01T15:47:29.562511Z", "id": "CVE-2024-14047", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-01T15:47:36.179Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-14047", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-01T15:47:29.562511Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-01T15:47:32.836Z"}}], "cna": {"title": "Improper Link Resolution Before File Access ('Link Following') in Winlogbeat Leading to Arbitrary File Write and Denial of Service", "source": {"discovery": "Elastic"}, "impacts": [{"capecId": "CAPEC-132", "descriptions": [{"lang": "en", "value": "CAPEC-132 Symlink Attack"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Elastic", "product": "Elastic Security", "versions": [{"status": "affected", "version": "7.6.0", "versionType": "semver", "lessThanOrEqual": "8.12.2"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://discuss.elastic.co/t/winlogbeat-8-13-0-security-update-esa-2024-49/390044"}], "x_generator": {"engine": "Elastic CVE Publisher 1.0.0"}, "descriptions": [{"lang": "en", "value": "A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation to write to or delete arbitrary files. Successful exploitation could result in a denial of service.", "supportingMedia": [{"type": "text/html", "value": "<p>A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation to write to or delete arbitrary files. Successful exploitation could result in a denial of service.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a", "shortName": "elastic", "dateUpdated": "2026-09-01T13:59:19.534Z"}}}, "cveMetadata": {"cveId": "CVE-2024-14047", "state": "PUBLISHED", "dateUpdated": "2026-09-01T15:47:36.179Z", "dateReserved": "2026-08-31T09:06:33.044Z", "assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a", "datePublished": "2026-09-01T13:59:19.534Z", "assignerShortName": "elastic"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Elastic Security", "vendor": "Elastic", "versions": [{"lessThanOrEqual": "8.12.2", "status": "affected", "version": "7.6.0", "versionType": "semver"}]}], "source": "security@elastic.co"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elastic:winlogbeat:*:*:*:*:*:*:*:*", "matchCriteriaId": "B0100FCB-D573-4A2A-B7F2-F4F58915B8F6", "versionEndExcluding": "8.13.0", "versionStartIncluding": "7.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation to write to or delete arbitrary files. Successful exploitation could result in a denial of service."}, {"lang": "es", "value": "Una vulnerabilidad local en el instalador de Winlogbeat para Windows provoc\u00f3 que los archivos en tiempo de ejecuci\u00f3n se colocaran en un directorio con permisos de escritura para usuarios sin privilegios. Un atacante de bajo privilegio con acceso previo al sistema podr\u00eda preposicionar enlaces maliciosos del sistema de archivos, lo que har\u00eda que una operaci\u00f3n posterior de Winlogbeat con privilegios elevados escribiera o eliminara archivos arbitrarios. La explotaci\u00f3n exitosa podr\u00eda resultar en una denegaci\u00f3n de servicio."}], "id": "CVE-2024-14047", "lastModified": "2026-10-27T18:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.8, "source": "security@elastic.co", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-14047", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-01T15:47:29.562511Z", "version": "2.0.3"}}]}, "published": "2026-09-01T14:17:23.827", "references": [{"source": "security@elastic.co", "tags": ["Vendor Advisory"], "url": "https://discuss.elastic.co/t/winlogbeat-8-13-0-security-update-esa-2024-49/390044"}], "sourceIdentifier": "security@elastic.co", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "security@elastic.co", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.6.0,8.12.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "elastic_security", "vendor": "elastic"}], "created": "2026-09-01T16:30:17.862898+00:00", "updated": "2026-09-03T16:27:56.933094+00:00", "vendors": ["elastic", "elastic$PRODUCT$elastic_security"]}