Tanium Asset SQL Injection Vulnerability

A SQL injection vulnerability has been identified in Tanium Asset, affecting multiple release versions prior to specific update releases. This vulnerability allows an authenticated user with the 'Asset API - Write' permission to manipulate the SQL queries executed by the Asset service.

Impact

Exploitation of this vulnerability could lead to unauthorized modification of SQL queries, potentially allowing for data manipulation or retrieval beyond the user's permissions.

Remediation

Users can update to Asset version 1.28.254 or later (for the 2024H1 release), version 1.32.161 or later (for the 2024H2 release), or version 1.33.250 or later (for the 2025H1 release) to address this vulnerability.