Cyber Resilience

CVE-2024-0833

HighLPE

Published: 31 January 2024

Published
31 January 2024
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0012 30.5th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-0833 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Progress Telerik Test Studio. Its CVSS base score is 7.8 (High).

Operationally, ranked at the 30.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

In Telerik Test Studio versions prior to v2023.3.1330, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik Test Studio install is present, a lower privileged user has the ability to…

more

manipulate the installation package to elevate their privileges on the underlying operating system.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

progress
telerik test studio
≤ 2023.3.1330

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-269 CWE-276

Policy addresses roles, responsibilities, and privilege management to prevent improper privilege assignments.

addresses: CWE-269 CWE-276

Implements core proper privilege management by restricting to only required rights.

addresses: CWE-269 CWE-276

Baseline configuration documents and controls privilege assignments, making improper privilege management harder to introduce or sustain.

addresses: CWE-276 CWE-269

Requiring the most restrictive settings instead of defaults prevents incorrect default permissions on resources.

addresses: CWE-269 CWE-276

Defines roles and responsibilities to ensure proper privilege management during configuration changes.

addresses: CWE-269 CWE-276

Designates roles and review processes for managing physical privileges and access rights.

addresses: CWE-276 CWE-269

Tailoring explicitly overrides or scopes default permission assignments in the baseline to match the system's actual risk and operational needs.

addresses: CWE-269 CWE-276

Centralized privilege assignment and oversight prevent ad-hoc or excessive privilege grants that occur when each system is configured independently.

References