« Volver al listado

CVE-2014-9141

Estado: ModificadaAlta (7.2)—

The installer in Thomson Reuters Fixed Assets CS 13.1.4 and earlier uses weak permissions for connectbgdl.exe, which allows local users to execute arbitrary code by modifying this program.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Thomsonreuters — Fixed Assets CS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-9141",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-12-03T01:59:01.330",
  "references": [
    {
      "url": "http://www.exploit-db.com/exploits/35423",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.information-paradox.net/2014/12/cve-2014-9141-thomson-reuters-fixed.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.exploit-db.com/exploits/35423",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.information-paradox.net/2014/12/cve-2014-9141-thomson-reuters-fixed.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The installer in Thomson Reuters Fixed Assets CS 13.1.4 and earlier uses weak permissions for connectbgdl.exe, which allows local users to execute arbitrary code by modifying this program."
    },
    {
      "lang": "es",
      "value": "El instalador en Thomson Reuters Fixed Assets CS 13.1.4 y anteriores utiliza permiso débiles para connectbgdl.exe, lo que permite a usuarios locales ejecutar código arbitrario mediante la modificación de este programa."
    }
  ],
  "lastModified": "2026-06-17T00:17:49.030",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:thomsonreuters:fixed_assets_cs:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F81FA41E-FE35-4C28-AB1A-A1ADC4F0610B",
              "versionEndIncluding": "13.1.4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}