CVE-2023-35800
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Stormshield Endpoint Security Evolution versions 2.0.0 through 2.4.2 has insecure permissions. An ACL entry on the SES Evolution agent directory containing the agent logs displayed in the GUI allows interactive users to read data, which could allow access to information reserved for administrators.
Risk Assessment
The risk to the organization is the potential for unauthorized access to sensitive information, which could lead to breaches of data confidentiality and possible non-compliance with security policies.
Recommendation
It is recommended to review and adjust the ACL permissions for the SES Evolution agent directory to restrict log access to authorized users only.
Original NVD description (English source)
Stormshield Endpoint Security Evolution 2.0.0 through 2.4.2 has Insecure Permissions. An ACL entry on the SES Evolution agent directory that contains the agent logs displayed in the GUI allows interactive users to read data, which could allow access to information reserved to administrators.