{"id":"CVE-2024-58288","state":"PUBLISHED","title":"Genexus Protection Server 9.7.2.10 Unquoted Service Path Privilege Escalation","description":"Genexus Protection Server 9.7.2.10 contains an unquoted service path vulnerability in the protsrvservice Windows service configuration. Attackers can exploit the unquoted binary path to execute arbitrary code with elevated LocalSystem privileges by placing malicious executables in specific file system locations.","publishedAt":"2025-12-11T21:33:58.572Z","updatedAt":"2026-07-28T01:47:43.141Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Genexus Genexus Protection Server"],"affected":[{"vendor":"Genexus","product":"Genexus Protection Server","defaultStatus":"unaffected","versions":[{"version":"9.7.2.10","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/52065","https://www.genexus.com/es/","https://www.genexus.com/en/developers/downloadcenter?data=;;","https://www.vulncheck.com/advisories/genexus-protection-server-unquoted-service-path-privilege-escalation"],"weaknesses":["CWE-428"],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/58xxx/CVE-2024-58288.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-58288","state":"PUBLISHED","datePublished":"2025-12-11T21:33:58.572Z","dateUpdated":"2026-07-28T01:47:43.141Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2025-12-10T23:46:14.009Z"},"containers":{"cna":{"title":"Genexus Protection Server 9.7.2.10 Unquoted Service Path Privilege Escalation","descriptions":[{"lang":"en","value":"Genexus Protection Server 9.7.2.10 contains an unquoted service path vulnerability in the protsrvservice Windows service configuration. Attackers can exploit the unquoted binary path to execute arbitrary code with elevated LocalSystem privileges by placing malicious executables in specific file system locations."}],"affected":[{"vendor":"Genexus","product":"Genexus Protection Server","defaultStatus":"unaffected","versions":[{"version":"9.7.2.10","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/52065","name":"ExploitDB-52065","tags":["exploit"]},{"url":"https://www.genexus.com/es/","name":"Official Genexus Homepage","tags":["product"]},{"url":"https://www.genexus.com/en/developers/downloadcenter?data=;;","name":"Genexus Software Download Center","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/genexus-protection-server-unquoted-service-path-privilege-escalation","name":"VulnCheck Advisory: Genexus Protection Server 9.7.2.10 Unquoted Service Path Privilege Escalation","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-428","description":"CWE-428: Unquoted Search Path or Element","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-07-28T01:47:43.141Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:avg:protection:9.7.2.10:*:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","type":"finder","value":"SamAlucard, Sam Alucard"}],"datePublic":"2024-07-31T00:00:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-18T19:39:23.224695Z","id":"CVE-2024-58288","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-18T19:39:32.649Z"}}]}}}