PT-2019-12376 · Code42 · Code42 For Enterprise

Publicado 2019-07-19 · Atualizado 2020-08-24 · CVE-2019-11553

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Code42 for Enterprise versions through 6.8.4

Description The issue allows an administrator without web restore permission but with user management capabilities to impersonate a user who has web restore permission. This can be achieved by requesting a token for web restore on behalf of the user they manage, effectively granting the administrator the user's permissions. The exploitation requires the administrator to have access to manage an organization that includes a user with greater permissions.

Recommendations For Code42 for Enterprise versions through 6.8.4, restrict access to user management for administrators without web restore permission to prevent impersonation. Additionally, consider limiting the ability of administrators to request tokens on behalf of other users as a temporary mitigation measure until a fix is available.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2019-11553

Produtos afetados

Code42 For Enterprise

Referências · 3

• https://code42.com/r/support/CVE-2019-11553 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-11553 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-11553 · Aviso do Fabricante