Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-42049
CVE-2024-42049:
TightVNC vulnerability analysis and mitigation
Overview
TightVNC (Server for Windows) before version 2.8.84 contains a security vulnerability that allows attackers to connect to the control pipe via a network connection. The vulnerability was discovered and disclosed in July 2024, affecting the Windows server component of TightVNC software (NVD, CVE).
Technical details
The vulnerability has been assigned CVE-2024-42049 and has received a CVSS v3.1 base score of 9.1 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The vulnerability is classified as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (NVD).
Impact
The vulnerability allows unauthorized network access to the control pipe, potentially exposing sensitive information and allowing attackers to gain control over the TightVNC server. This could lead to unauthorized access to the affected systems and potential exposure of sensitive data (NVD).
Mitigation and workarounds
The vulnerability has been fixed in TightVNC version 2.8.84. The update disables the ability to connect to the control pipe via network connections, disables the transmission of passwords through the pipe from the server to the control application, and ensures the server only accepts control connections from processes launched from the same path as the server itself on Windows Vista and later (TightVNC Changelog).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management