{"id":"CVE-2024-4461","state":"PUBLISHED","title":"Unquoted path or search item vulnerability in SugarSync","description":"Unquoted path or search item vulnerability in SugarSync versions prior to 4.1.3 for Windows. This misconfiguration could allow an unauthorized local user to inject arbitrary code into the unquoted service path, resulting in privilege escalation.","publishedAt":"2024-05-03T10:52:25.899Z","updatedAt":"2024-08-01T20:40:47.107Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"INCIBE"},"assigner":"INCIBE","products":["SugarSync SugarSync"],"affected":[{"vendor":"SugarSync","product":"SugarSync","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.1.3","versionType":"custom"}]}],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/unquoted-path-or-search-item-vulnerability-sugarsync"],"weaknesses":["CWE-428"],"ingestedAt":"2026-10-29T20:07:56.516Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/4xxx/CVE-2024-4461.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-4461","state":"PUBLISHED","datePublished":"2024-05-03T10:52:25.899Z","dateUpdated":"2024-08-01T20:40:47.107Z","assignerShortName":"INCIBE","assignerOrgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateReserved":"2024-05-03T07:06:22.294Z"},"containers":{"cna":{"title":"Unquoted path or search item vulnerability in SugarSync","descriptions":[{"lang":"en","value":"Unquoted path or search item vulnerability in SugarSync versions prior to 4.1.3 for Windows. This misconfiguration could allow an unauthorized local user to inject arbitrary code into the unquoted service path, resulting in privilege escalation."}],"affected":[{"vendor":"SugarSync","product":"SugarSync","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.1.3","versionType":"custom"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/unquoted-path-or-search-item-vulnerability-sugarsync"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-428","description":"CWE-428 Unquoted Search Path or Element","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"INCIBE","orgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateUpdated":"2024-05-03T10:52:25.899Z"},"credits":[{"lang":"en","type":"finder","value":"Jorge Manuel Lozano Gómez"}],"datePublic":"2024-05-03T10:00:00.000Z","impacts":[{"capecId":"CAPEC-38","descriptions":[{"lang":"en","value":"CAPEC-38 Leveraging/Manipulating Configuration File Search Paths"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"There is no reported solution at this time."}],"value":"There is no reported solution at this time."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"sugarsync","product":"sugarsync","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"4.1.3","versionType":"custom"}],"cpes":["cpe:2.3:a:sugarsync:sugarsync:4.1.3:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-05-16T19:14:42.688465Z","id":"CVE-2024-4461","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-06T19:49:54.155Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/unquoted-path-or-search-item-vulnerability-sugarsync","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T20:40:47.107Z"}}]}}}