CVE-2023-44219: 
SonicWall Directory Services Connector vulnerability analysis and mitigation

A local privilege escalation vulnerability (CVE-2023-44219) was identified in SonicWall Directory Services Connector Windows MSI client version 4.1.21 and earlier versions. The vulnerability was disclosed on October 27, 2023, and affects the Windows client component of the SonicWall Directory Services Connector (NVD Database).

The vulnerability is classified as CWE-269 (Improper Privilege Management) with a CVSS v3.1 base score of 7.8 (HIGH). The attack vector is local (AV:L), with low attack complexity (AC:L), requiring low privileges (PR:L), and no user interaction (UI:N). The scope is unchanged (S:U), with high impacts on confidentiality (C:H), integrity (I:H), and availability (A:H) (NVD Database).

The vulnerability allows a local low-privileged user to gain system privileges through exploitation of the recovery feature. This represents a significant security risk as it enables unauthorized elevation of privileges on affected systems (NVD Database).

The vulnerability requires local access and low privileges to exploit. The attack complexity is rated as low, indicating that the vulnerability is relatively straightforward to exploit once an attacker has local access to the system (NVD Database).

SonicWall has released version 4.1.22 of the Directory Services Connector Windows client to address this vulnerability. Users are advised to upgrade to this latest version to mitigate the security risk (CERT-FR Advisory).