PT-2019-12446 · Oneshield · Oneshield Policy

Ghost + 1 · Publicado 2019-05-08 · Atualizado 2020-08-24 · CVE-2019-11642

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OneShield Policy (Dragon Core) versions prior to 5.1.10

Description A log poisoning issue has been found, allowing authenticated remote adversaries to poison log files by entering malicious payloads in either headers or form elements, which are then executed via a client-side debugging console. This issue is dependent on the debugging console and Java Bean being accessible to the deployed application.

Recommendations For versions prior to 5.1.10, update to version 5.1.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the debugging console and Java Bean to minimize the risk of exploitation.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2019-11642

Produtos afetados

Oneshield Policy

Referências · 4

• https://oneshield.com/business-solutions/oneshield-pc-solutions/oneshield-policy · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-11642 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11642 · Nota de Segurança
• http://seclists.org/fulldisclosure/2019/May/1 · Nota