Tanium Deploy Improper Input Validation Vulnerability Allowing Unauthorized Code Execution
Vulnerability
An improper input validation vulnerability has been identified in Tanium Deploy, specifically in versions prior to v2.26.1279 for the 7.4 and 7.5 releases, and in the 2024H2 release prior to Update 3 (v2.30.175). This vulnerability could enable an authenticated Tanium user with specific permissions to execute unauthorized code on all endpoints within the Deploy context.
Impact
Exploitation of this vulnerability could allow an authenticated user with the 'Deploy Deployment - Write' and 'Deploy Software Package - Write' permissions to execute unauthorized code on endpoints, affecting the Deploy application.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.