Home

Description

Inclusion of functionality from an untrusted control sphere in Elastic Agent subprocess, osqueryd, allows local attackers to execute arbitrary code via parameter injection. An attacker requires local access and the ability to modify osqueryd configurations.

PUBLISHED Reserved 2024-11-18 | Published 2025-05-01 | Updated 2025-05-01 | Assigner elastic




MEDIUM: 4.4CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Problem types

CWE-829 Inclusion of Functionality from Untrusted Control Sphere

Product status

Default status
unaffected

7.0.0 (semver)
affected

8.0.0 (semver)
affected

References

discuss.elastic.co/...5-4-security-update-esa-2024-39/377708

cve.org (CVE-2024-52976)

nvd.nist.gov (CVE-2024-52976)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.