PT-2019-13086 · Belgium · Eid Client

Publicado 2019-06-28 · Atualizado 2019-07-05 · CVE-2019-13028

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eID client versions prior to 3.1.2 (Windows) eID client versions prior to 3.0.3 (Linux)

Description The issue arises from an incorrect implementation of a local web server in the eID client, allowing remote attackers to execute arbitrary code, such as files with .cgi, .pl, or .php extensions, or delete arbitrary files. This can be achieved via a crafted HTML page.

Recommendations For Windows versions prior to 3.1.2, update to version 3.1.2 or later to resolve the issue. For Linux versions prior to 3.0.3, update to version 3.0.3 or later to resolve the issue.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2019-13028

Produtos afetados

Eid Client

Referências · 5

• 🔥 https://csirt.gov.sk/aktualne-7d7.html?id=194 · Exploit
• https://csirt.gov.sk/doc/eid_klient_tlacova_sprava.pdf · Nota
• https://osv.dev/vulnerability/CVE-2019-13028 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-13028 · Nota de Segurança
• https://minv.sk/?tlacove-spravy&sprava=pouzivatelom-e-sluzieb-automaticky-aktualizujeme-aplikaciu-pre-elektronicky-obciansky-preukaz · Nota