CVE-2024-9875

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-9875", "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a", "state": "PUBLISHED", "assignerShortName": "Okta", "dateReserved": "2024-10-11T16:36:50.988Z", "datePublished": "2024-11-20T22:23:15.230Z", "dateUpdated": "2024-11-22T15:25:43.803Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Okta Privileged Access Server Agent (SFTD)", "vendor": "Okta", "versions": [{"version": "1.82.0", "status": "affected", "lessThan": "1.84.0", "versionType": "semver"}]}], "datePublic": "2024-11-20T22:15:00.000Z", "descriptions": [{"lang": "en", "value": "Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation vulnerability when the sudo command bundles feature is enabled. To remediate this vulnerability, upgrade the Okta Privileged Access server agent (SFTD) to version 1.87.1 or greater."}], "metrics": [{"cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a", "shortName": "Okta", "dateUpdated": "2024-11-20T22:38:32.486Z"}, "references": [{"url": "https://help.okta.com/asa/en-us/content/topics/releasenotes/advanced-server-access-release-notes.htm"}], "solutions": [{"lang": "en", "value": "To remediate this vulnerability, upgrade the Okta Privileged Access server agent (SFTD) to version 1.87.1 or greater."}], "credits": [{"lang": "en", "value": "Okta would like to thank Anvil Secure for discovering this vulnerability.", "type": "reporter"}]}, "adp": [{"affected": [{"vendor": "okta", "product": "privileged_access_server_agent_sftd", "cpes": ["cpe:2.3:a:okta:privileged_access_server_agent_sftd:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "1.82.0", "status": "affected", "lessThan": "1.84.0", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-22T15:23:16.211195Z", "id": "CVE-2024-9875", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-22T15:25:43.803Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-9875", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-22T15:23:16.211195Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:okta:privileged_access_server_agent_sftd:*:*:*:*:*:*:*:*"], "vendor": "okta", "product": "privileged_access_server_agent_sftd", "versions": [{"status": "affected", "version": "1.82.0", "lessThan": "1.84.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-22T15:25:38.745Z"}}], "cna": {"credits": [{"lang": "en", "type": "reporter", "value": "Okta would like to thank Anvil Secure for discovering this vulnerability."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Okta", "product": "Okta Privileged Access Server Agent (SFTD)", "versions": [{"status": "affected", "version": "1.82.0", "lessThan": "1.84.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "To remediate this vulnerability, upgrade the Okta Privileged Access server agent (SFTD) to version 1.87.1 or greater."}], "datePublic": "2024-11-20T22:15:00.000Z", "references": [{"url": "https://help.okta.com/asa/en-us/content/topics/releasenotes/advanced-server-access-release-notes.htm"}], "descriptions": [{"lang": "en", "value": "Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation vulnerability when the sudo command bundles feature is enabled. To remediate this vulnerability, upgrade the Okta Privileged Access server agent (SFTD) to version 1.87.1 or greater."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "59b22baa-87b2-4371-8e4a-e080df12f74a", "shortName": "Okta", "dateUpdated": "2024-11-20T22:38:32.486Z"}}}, "cveMetadata": {"cveId": "CVE-2024-9875", "state": "PUBLISHED", "dateUpdated": "2024-11-22T15:25:43.803Z", "dateReserved": "2024-10-11T16:36:50.988Z", "assignerOrgId": "59b22baa-87b2-4371-8e4a-e080df12f74a", "datePublished": "2024-11-20T22:23:15.230Z", "assignerShortName": "Okta"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Okta Privileged Access Server Agent (SFTD)", "vendor": "Okta", "versions": [{"lessThan": "1.84.0", "status": "affected", "version": "1.82.0", "versionType": "semver"}]}], "source": "psirt@okta.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:okta:privileged_access_server_agent_sftd:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "privileged_access_server_agent_sftd", "vendor": "okta", "versions": [{"lessThan": "1.84.0", "status": "affected", "version": "1.82.0", "versionType": "semver"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation vulnerability when the sudo command bundles feature is enabled. To remediate this vulnerability, upgrade the Okta Privileged Access server agent (SFTD) to version 1.87.1 or greater."}, {"lang": "es", "value": "Las versiones 1.82.0 a 1.84.0 de Okta Privileged Access server agent (SFTD) se ven afectadas por una vulnerabilidad de escalada de privilegios cuando la funci\u00f3n de paquetes de comandos sudo est\u00e1 habilitada. Para solucionar esta vulnerabilidad, actualice el agente de servidor de acceso privilegiado de Okta (SFTD) a la versi\u00f3n 1.87.1 o posterior."}], "id": "CVE-2024-9875", "lastModified": "2026-06-17T08:25:25.387", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "psirt@okta.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-9875", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-11-22T15:23:16.211195Z", "version": "2.0.3"}}]}, "published": "2024-11-21T09:54:49.903", "references": [{"source": "psirt@okta.com", "url": "https://help.okta.com/asa/en-us/content/topics/releasenotes/advanced-server-access-release-notes.htm"}], "sourceIdentifier": "psirt@okta.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "psirt@okta.com", "type": "Secondary"}]}

{}

{}