An incorrect default permissions vulnerability has been identified in Tanium Patch, prior to Update 6 (v3.24.137). This vulnerability allows an authenticated Tanium user with specific service account permissions to read and write all platform content. The affected permissions include Partner Integration Service Account, Patch Service Account, Benchmark Service Account, Performance Components Manage, Discover Components Manage, and Comply Components Manage.
Exploitation of this vulnerability could enable an authenticated user with the specified permissions to access and modify all platform content, potentially leading to unauthorized changes or data exposure.
Users can update to Tanium Patch version 3.24.137 or later to address this vulnerability.
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.
