Unknown
CVE-2024-49360
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
Unknown
(0 users assessed)
Unknown
(0 users assessed)Unknown
Unknown
Unknown
CVE-2024-49360
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Topic Tags
Description
Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. An authenticated user (UserA) with no privileges is authorized to read all files created in sandbox belonging to other users in the sandbox folders C:\Sandbox\UserB\xxx. An authenticated attacker who can use explorer.exe or cmd.exe outside any sandbox can read other users’ files in C:\Sandbox\xxx. By default in Windows 7+, the C:\Users\UserA folder is not readable by UserB.
All files edited or created during the sandbox processing are affected by the vulnerability. All files in C:\Users are safe. If UserB runs a cmd in a sandbox, he will be able to access C:\Sandox\UserA. In addition, if UserB create a folder C:\Sandbox\UserA with malicious ACLs, when UserA will user the sandbox, Sandboxie doesn’t reset ACLs ! This issue has not yet been fixed. Users are advised to limit access to their systems using Sandboxie.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
General Information
Vendors
Products
References
Additional Info
Technical Analysis
Report as Emergent Threat Response
Report as Zero-day Exploit
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
