CVE-2024-1591 Privilege Management for Windows < 24.1 Information Leak

What is CVE-2024-1591?

CVE-2024-1591 is a low-severity vulnerability in BeyondTrust Privilege Management for Windows, published on 16 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Prior to version 24.1, a local authenticated attacker can view Sysvol when Privilege Management for Windows is configured to use a GPO policy. This allows them to view the policy and potentially find configuration issues.

Weakness: CWE-200

Which versions are affected by CVE-2024-1591?

It affects 1 product.

Products include Beyondtrust Privilege Management for Windows.

How do I fix CVE-2024-1591?

No fix has been published for CVE-2024-1591 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-1591 being exploited?

There is no known exploitation of CVE-2024-1591 in the wild and no public exploit code.

Other vulnerabilities in BeyondTrust Privilege Management for Windows

• CVE-2020-12613 Privilege escalation in n/a High 8.8
• CVE-2020-12614 Privilege escalation in n/a High 8.4
• CVE-2020-12612 Privilege escalation in n/a High 7.8
• CVE-2020-12615 Privilege escalation in n/a High 7.8
• CVE-2020-28369 Path traversal in n/a High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fg82-j7qh-mwr5.