CVE-2019-14969

High

Description

Netwrix Auditor before 9.8 has insecure permissions on %PROGRAMDATA%\Netwrix Auditor\Logs\ActiveDirectory\ and sub-folders. In addition, the service Netwrix.ADA.StorageAuditService (which writes to that directory) does not perform proper impersonation, and thus the target file will have the same permissions as the invoking process (in this case, granting Authenticated Users full access over the target file). This vulnerability can be triggered by a low-privileged user to perform DLL Hijacking/Binary Planting attacks and ultimately execute code as NT AUTHORITY\SYSTEM with the help of Symbolic Links.

SeverityHigh

CVSS7.8

Exploit probability—

ProductNetwrix Auditor

PublishedAug 12, 2019

First seenAug 12, 2019

How to fix

Update

netwrix auditor9.8 or later

Affected products

Product	Affected versions	Fixed in
netwrix auditor	v < 9.8	9.8

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.