SB2024040814 - Privilege escalation in YubiKey Manager

Description

This security bulletin contains information about 1 vulnerability.

1) Permissions, Privileges, and Access Controls (CVE-ID: N/A)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions. If a user runs the YubiKey Manager GUI as Administrator, browser windows opened by YubiKey Manager GUI may be opened as Administrator which could be exploited by a local attacker to perform actions as Administrator.

Remediation

Install update from vendor's website.

References

• https://github.com/Yubico/yubikey-manager-qt/releases/tag/yubikey-manager-qt-1.2.6
• https://www.yubico.com/support/security-advisories/ysa-2024-01/