CVEvulnerability

CVE-2024-47856

9.8 CRITICAL Published 2025-11-24 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-11-24
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-23

Description

In RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks. An adversary can place an executable in a higher-level directory of the path, and Windows will resolve that executable instead of the intended executable.

Affected configurations

• rsa authentication agent for windows (< 7.4.7)

Related

Weakness · CWE (1)

  • CWE-23 Relative Path Traversal weakness

References