CVE-2025-43079
BaseFortify
Publication date: 2025-11-10
Last updated on: 2025-11-18
Assigner: Qualys, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| qualys | cloud_agent | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-732 | The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. |
| CWE-426 | The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the Qualys Cloud Agent's uninstall script for MacOS and Linux, which calls system commands without using absolute paths and does not sanitize the $PATH environment variable. If the script is run with elevated privileges in an environment where $PATH is manipulated, an attacker with root or sudo access could trick the script into running malicious executables instead of legitimate system binaries. This can lead to local privilege escalation and arbitrary command execution with elevated privileges.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker with some elevated privileges to escalate their privileges further or execute arbitrary commands as root or with sudo rights. This could compromise the security and integrity of the affected system, potentially allowing unauthorized control or damage.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, avoid running the Qualys Cloud Agent uninstall script (qagent_uninstall.sh) with elevated privileges in an environment where the $PATH variable may be manipulated. Ensure that the $PATH environment variable is sanitized and uses absolute paths before executing the uninstall script. Additionally, restrict root/sudo access to trusted users to prevent exploitation of this local privilege escalation vulnerability.