CVE-2024-14047

{
  "id": "CVE-2024-14047",
  "sourceIdentifier": "[email protected]",
  "published": "2026-09-01T14:17:23.827",
  "lastModified": "2026-10-27T18:10:00.130",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation to write to or delete arbitrary files. Successful exploitation could result in a denial of service."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad local en el instalador de Winlogbeat para Windows provocó que los archivos en tiempo de ejecución se colocaran en un directorio con permisos de escritura para usuarios sin privilegios. Un atacante de bajo privilegio con acceso previo al sistema podría preposicionar enlaces maliciosos del sistema de archivos, lo que haría que una operación posterior de Winlogbeat con privilegios elevados escribiera o eliminara archivos arbitrarios. La explotación exitosa podría resultar en una denegación de servicio."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Elastic",
          "product": "Elastic Security",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "7.6.0",
              "lessThanOrEqual": "8.12.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 5.8
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-09-01T15:47:29.562511Z",
          "id": "CVE-2024-14047",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:elastic:winlogbeat:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "7.6.0",
              "versionEndExcluding": "8.13.0",
              "matchCriteriaId": "B0100FCB-D573-4A2A-B7F2-F4F58915B8F6"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://discuss.elastic.co/t/winlogbeat-8-13-0-security-update-esa-2024-49/390044",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}