Michael Baer

**Name of the Vulnerable Software and Affected Versions** Palo Alto Networks GlobalProtect App versions prior to 6.2.5 **Description** A privilege escalation issue in the Palo Alto Networks GlobalProtect app on Windows allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY/SYSTEM through the use of the repair functionality offered by the .msi file used to install GlobalProtect. **Recommendations** Update to version 6.2.5 to resolve the issue. As a temporary workaround, consider disabling the repair functionality offered by the .msi file used to install GlobalProtect until a patch is available. Restrict access to the .msi file used to install GlobalProtect to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Nitro PDF Pro versions prior to 13.70.8.82 Nitro PDF Pro versions 14.x prior to 14.26.1.0 **Description** The issue allows Local Privilege Escalation in the MSI Installer because custom actions occur unsafely in repair mode. CertUtil is run in a conhost.exe window, and there is a mechanism allowing CTRL+o to launch cmd.exe as NT AUTHORITYSYSTEM. **Recommendations** For Nitro PDF Pro versions prior to 13.70.8.82, update to version 13.70.8.82 or later. For Nitro PDF Pro versions 14.x prior to 14.26.1.0, update to version 14.26.1.0 or later. As a temporary workaround, consider restricting the use of the MSI Installer in repair mode until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows Installer (affected versions not specified) **Description** The Windows Installer component contains a flaw in access control management. Successful exploitation of this issue could allow an attacker to elevate privileges to the SYSTEM level. This issue is actively being exploited in real-world attacks. The vulnerability involves improper privilege management within the repair functions of Microsoft Windows MSI installers, potentially allowing local attackers to escalate privileges. The `msiscan` tool is available to identify potentially vulnerable MSI installers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SoftMaker Office 2024 / NX versions prior to revision 1214 SoftMaker FreeOffice 2014 versions prior to revision 1215 SoftMaker FreeOffice 2021 (no fix available) **Description** An issue was discovered in the SoftMaker Office and FreeOffice MSI installer files, which produce a visible conhost.exe window running as the SYSTEM user when using the repair function of msiexec.exe. This allows a local, low-privileged attacker to use a chain of actions to open a fully functional cmd.exe with the privileges of the SYSTEM user. **Recommendations** For SoftMaker Office 2024 / NX versions prior to revision 1214, update to revision 1214 or later. For SoftMaker FreeOffice 2014 versions prior to revision 1215, update to revision 1215 or later. For SoftMaker FreeOffice 2021, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the repair function of msiexec.exe to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Checkmk versions prior to 2.2.0p23 Checkmk versions prior to 2.1.0p40 Checkmk version 2.0.0 **Description** The issue is related to an uncontrolled search path element in the Checkmk software, which can be exploited to escalate privileges. This allows a local user to gain elevated access. The vulnerability affects the Windows agent plugin in Checkmk. **Recommendations** For Checkmk versions prior to 2.2.0p23, update to version 2.2.0p23 or later to resolve the issue. For Checkmk versions prior to 2.1.0p40, update to version 2.1.0p40 or later to resolve the issue. For Checkmk version 2.0.0, consider upgrading to a supported version, as 2.0.0 has reached its end-of-life. As a temporary workaround, consider restricting access to the Windows agent plugin to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Payara Platform Community versions prior to 4.1.2.191.38 Payara Platform Community versions 5.x prior to 5.2022.4 Payara Platform Community versions 6.x prior to 6.2022.1 Payara Platform Enterprise versions prior to 5.45.0 **Description** The issue allows attackers to access sensitive directories, specifically META-INF and WEB-INF, when Payara is deployed to the root context. This is a distinct issue from other known vulnerabilities. **Recommendations** For Payara Platform Community versions prior to 4.1.2.191.38, update to version 4.1.2.191.38 or later. For Payara Platform Community versions 5.x prior to 5.2022.4, update to version 5.2022.4 or later. For Payara Platform Community versions 6.x prior to 6.2022.1, update to version 6.2022.1 or later. For Payara Platform Enterprise versions prior to 5.45.0, update to version 5.45.0 or later.