CVE-2024-2658
High
Description
A misconfiguration in lmadmin.exe of FlexNet Publisher versions prior to 2024 R1 (11.19.6.0) allows the OpenSSL configuration file to load from a non-existent directory. An unauthorized, locally authenticated user with low privileges can potentially create the directory and load a specially crafted openssl.conf file leading to the execution of a malicious DLL (Dynamic-Link Library) with elevated privileges.
SeverityHigh
CVSS8.5
Exploit probability—
Product
FlexNet Publisher
PublishedJan 30, 2025
First seenJan 30, 2025
Weakness typeCWE-427CWE-427
How to fix
Update
- Flexera FlexNet Publisher2024 R1 (11.19.6.0) or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Flexera FlexNet Publisher | v < 2024 R1 (11.19.6.0) | 2024 R1 (11.19.6.0) |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.