What is CVE-2023-28142?

CVE-2023-28142 is a medium-severity vulnerability in Qualys Cloud Agent, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 6.7/10. Published 2023-04-18.

How severe is CVE-2023-28142?

Medium severity. CVSS v3 base score is 6.7 out of 10.

Vulnerability in Qualys Cloud Agent

CVE-2023-28142

A Race Condition exists in the Qualys Cloud Agent for Windows platform in versions from 3.1.3.34 and before 4.5.3.1. This allows attackers to escalate privileges limited on the local machine during uninstallation of the Qualys Cloud Agent for Windows. Attackers may gain SYSTEM level privileges on that asset to run arbitrary commands. At the time of this disclosure, versions before 4.0 are classified as End of Life.

Vulnerability class: Race Condition

EPSS: 0.001 (3.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H.

Affected products

Qualys Cloud Agent — versions 3.1.3.34
Qualys Cloud_agent

Weakness classification (CWE)

CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)

References

bugreport@qualys.com (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2023-28142?: CVE-2023-28142 is a medium-severity vulnerability in Qualys Cloud Agent, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 6.7/10. Published 2023-04-18.
How severe is CVE-2023-28142?: Medium severity. CVSS v3 base score is 6.7 out of 10.