The version of BeyondTrust Privileged Remote Access (PRA) running on the remote host is prior or equal to 24.3.1. It is, therefore, potentially affected by multiple vulnerabilities.

  - All BeyondTrust Privileged Remote Access (PRA) versions contain a command injection vulnerability which can be   exploited through a malicious client request. Successful exploitation of this vulnerability can allow an   unauthenticated remote attacker to execute underlying operating system commands within the context of the   site user. This issue is fixed through a patch available for all supported releases of RS & PRA 22.1.x and   higher. (CVE-2024-12356)

  - All BeyondTrust Privileged Remote Access (PRA) versions contain a command injection vulnerability that can be   exploited by a user with existing administrative privileges to upload a malicious file. Successful   exploitation of this vulnerability can allow a remote attacker to execute underlying operating system   commands within the context of the site user. This issue is fixed through a patch available for all   supported releases of RS & PRA 22.1.x and higher. (CVE-2024-12686)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

BeyondTrust Privileged Remote Access (PRA) <= 24.3.1 Multiple Vulnerabilities

critical Nessus Plugin ID 213465

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.5 Feb 18, 2025, 8:30 AM Exploit attributes ("Exploit framework metasploit" set to "True") Plugin Feed: 202502180830
Version 1.4 Jan 14, 2025, 3:40 PM CISA reference Plugin Feed: 202501141540
Version 1.3 Jan 13, 2025, 10:27 PM CISA reference Plugin Feed: 202501132227
Version 1.2 Jan 3, 2025, 2:51 PM New Plugin Feed: 202501031451
Version 1.1 Jan 2, 2025, 6:26 PM New Plugin Feed: 202501021826