Tanium Asset SQL Injection Vulnerability

A SQL injection vulnerability has been identified in Tanium Asset, affecting multiple release versions prior to specific update releases. This vulnerability allows an authenticated Tanium user with the Asset Report Write permission to read, create, or modify objects in the Asset database that they may not typically have access to.

Impact

Exploitation of this vulnerability could lead to unauthorized reading, creation, or modification of objects in the Asset database, bypassing normal access controls.

Remediation

Users can update to Asset version 1.32.179 or later, version 1.33.269 or later, or version 1.36.108 or later, depending on their current release.