CVE-2024-3460
Assigner: CERT-PL
Published: 2024-05-09T10:13:37.634Z
State: PUBLISHED
affected: defaultStatus: unaffected
platforms: Windows
product: Kioware
vendor: Kioware
versions: lessThanOrEqual: 8.34
status: affected
version: 0
versionType: semver
credits: type: finder
value: Maksymilian Kubiak [Afine Team]
datePublic: 2024-05-09T10:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: <span style="background-color: rgb(255, 255, 255);">In KioWare for Windows (versions all <span style="background-color: rgb(255, 255, 255);">through 8.34)</span>&nbsp;it is possible to exit this software&nbsp;<span style="background-color: rgb(255, 255, 255);">and use other already opened applications utilizing a short time window before the forced automatic logout occurs. Then, by using some built-in function of these applications, one may launch any other programs.&nbsp;<br>In order to exploit this vulnerability external applications must be left running when the KioWare software is launched. Additionally, an attacker must know&nbsp;</span>the PIN set for this Kioware instance and also slow down the application with some specific task which extends the usable time window.</span><br><p><br></p>
value: In KioWare for Windows (versions all through 8.34) it is possible to exit this software and use other already opened applications utilizing a short time window before the forced automatic logout occurs. Then, by using some built-in function of these applications, one may launch any other programs. 
In order to exploit this vulnerability external applications must be left running when the KioWare software is launched. Additionally, an attacker must know the PIN set for this Kioware instance and also slow down the application with some specific task which extends the usable time window.


metrics: cvssV3_1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-424
description: CWE-424 Improper Protection of Alternate Path
type: CWE
source: discovery: UNKNOWN
x_generator: engine: Vulnogram 0.1.0-dev