CVE-2024-14047

A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation to write to or delete arbitrary files. Successful exploitation could result in a denial of service.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 0.8 / Impact : 5.8

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://discuss.elastic.co/t/winlogbeat-8-13-0-security-update-esa-2024-49/390044	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:elastic:winlogbeat:*:*:*:*:*:*:*:*

History

27 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad local en el instalador de Winlogbeat para Windows provocó que los archivos en tiempo de ejecución se colocaran en un directorio con permisos de escritura para usuarios sin privilegios. Un atacante de bajo privilegio con acceso previo al sistema podría preposicionar enlaces maliciosos del sistema de archivos, lo que haría que una operación posterior de Winlogbeat con privilegios elevados escribiera o eliminara archivos arbitrarios. La explotación exitosa podría resultar en una denegación de servicio.

Information

Published : 2026-09-01 14:17

Updated : 2026-10-27 18:10

NVD link : CVE-2024-14047

Mitre link : CVE-2024-14047

CVE.ORG link : CVE-2024-14047

JSON object : View

Products Affected

elastic

winlogbeat

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

{"id": "CVE-2024-14047", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-14047", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-01T15:47:29.562511Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@elastic.co", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.8, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security@elastic.co", "affectedData": [{"vendor": "Elastic", "product": "Elastic Security", "versions": [{"status": "affected", "version": "7.6.0", "versionType": "semver", "lessThanOrEqual": "8.12.2"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-01T14:17:23.827", "references": [{"url": "https://discuss.elastic.co/t/winlogbeat-8-13-0-security-update-esa-2024-49/390044", "tags": ["Vendor Advisory"], "source": "security@elastic.co"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@elastic.co", "description": [{"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation to write to or delete arbitrary files. Successful exploitation could result in a denial of service."}, {"lang": "es", "value": "Una vulnerabilidad local en el instalador de Winlogbeat para Windows provoc\u00f3 que los archivos en tiempo de ejecuci\u00f3n se colocaran en un directorio con permisos de escritura para usuarios sin privilegios. Un atacante de bajo privilegio con acceso previo al sistema podr\u00eda preposicionar enlaces maliciosos del sistema de archivos, lo que har\u00eda que una operaci\u00f3n posterior de Winlogbeat con privilegios elevados escribiera o eliminara archivos arbitrarios. La explotaci\u00f3n exitosa podr\u00eda resultar en una denegaci\u00f3n de servicio."}], "lastModified": "2026-10-27T18:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elastic:winlogbeat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0100FCB-D573-4A2A-B7F2-F4F58915B8F6", "versionEndExcluding": "8.13.0", "versionStartIncluding": "7.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@elastic.co"}