CVE-2023-28142
Race Condition
- State
- Published
- Severity
- 6.7 Medium
- Published
- Apr 18, 2023
- Updated
- Mar 3, 2025
- Reserved
- Mar 10, 2023
Description
A Race Condition exists in the Qualys Cloud Agent for Windows platform in versions from 3.1.3.34 and before 4.5.3.1. This allows attackers to escalate privileges limited on the local machine during uninstallation of the Qualys Cloud Agent for Windows. Attackers may gain SYSTEM level privileges on that asset to run arbitrary commands.
At the time of this disclosure, versions before 4.0 are classified as End of Life.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.7 Medium | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H | Qualys |
Weaknesses
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected Products
| Product | Versions |
|---|---|
Cloud AgentQualys |
|
References
- https://www.qualys.com/security-advisories/vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.