CVE-2023-24460

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Incorrect default permissions in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
n/a	Intel(R) GPA software installers	before version 2023.3
intel	graphics_performance_analyzer	< 2023.3

References

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00831.htmlVendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00831.htmlVendor Advisory

Timeline

Published: May 16, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-244615.9An improper certificate validation vulnerability exists in the BIG-IP Edge Client for Windows and macOS and may allow an attacker to imperso CVE-2023-244634.3Improper input validation in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an unauthenticated user to po CVE-2023-244645.4Stored-cross-site scripting vulnerability in Buffalo network devices allows an attacker with access to the web management console of the pro CVE-2023-244655.5Communication Wi-Fi subsystem within OpenHarmony-v3.1.4 and prior versions, OpenHarmony-v3.0.7 and prior versions has a null pointer refere CVE-2023-244669.8Possible XML External Entity Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0200.CVE-2023-244679.8Possible Command Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0000.CVE-2023-244689.8Broken access control in Advanced Authentication versions prior to 6.4.1.1 and 6.3.7.2 CVE-2023-244696.1Potential Cross-Site Scripting in ArcSight Logger versions prior to 7.3.0 CVE-2023-24476.1The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing CVE-2023-244709.1Potential XML External Entity Injection in ArcSight Logger versions prior to 7.3.0.CVE-2023-244716.5An access control vulnerability was found, due to the restrictions that are applied on actual assertions not being enforced in their debug f CVE-2023-244727.5A denial of service vulnerability exists in the FitsOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.7.1. A specially c