Vulnerabilidades de Drivelock
CVEs publicadas que afetam produtos de Drivelock: 8 registro(s), com severidade, exploração e correções.
CVE-2025-67794
Média · 6.1
CWE-732 17/12/2025
Incorrect Permission Assignment for Critical Resource em Drivelock
An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25.1.6. Directories and files created by the agent are created with overly permissive ACLs, allowing local users without administrator rights to trigger actions or destabilize the agent.
CVE-2025-67791
Crítica · 9.8
CWE-287 17/12/2025
Improper Authentication em Drivelock
An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through 25.1.*. An incomplete configuration (agent authentication) in DriveLock tenant allows attackers to impersonate any DriveLock agent on the network against the DES (DriveLock Enterprise Service).
CVE-2025-67793
Crítica · 9.8
CWE-269 17/12/2025
Improper Privilege Management em Drivelock
An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6. Users with the "Manage roles and permissions" privilege can promote themselves or other DOC users to the Supervisor role through an API call. This privilege is included by default in the Administrator role. This issue mainly affects cloud multi-tenant deployments; on-prem single-tenant installations are typically not impacted because local admins usually already have Supervisor privileges.
CVE-2025-67792
Alta · 7.8
CWE-269 17/12/2025
Improper Privilege Management em Drivelock
An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged users can manipulate a DriveLock process to execute arbitrary commands on Windows computers.
CVE-2025-67790
Alta · 7.5
CWE-170 17/12/2025
An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1…
An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. An unprivileged user could cause occasionally a Blue Screen Of Death (BSOD) on Windows computers by using an IOCTL and an unterminated string.
CVE-2025-67789
Média · 5.3
CWE-284 17/12/2025
Improper Access Control em Drivelock
An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Authenticated users can retrieve the computer count of other DriveLock tenants via the DriveLock API.
CVE-2025-67787
Crítica · 9.6
CWE-79 17/12/2025
Cross-site Scripting (XSS) em Drivelock
An issue was discovered in 25.1.2 before 25.1.5. A Cross Site Scripting (XSS) issue in DriveLock Operations Center allows for session takeover over a network.
CVE-2025-67781
Crítica · 9.9
CWE-269 17/12/2025
Improper Privilege Management em Drivelock
An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged users can manipulate privileged processes to gain more privileges on Windows computers.