PT-2019-13457 · Logmein · Join.Me

Publicado 2019-07-17 · Atualizado 2020-08-24 · CVE-2019-13637

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LogMeIn join.me versions prior to 3.16.0.5505

Description The issue arises from unsafe search paths used by the application URI defined in Windows, allowing an attacker to execute arbitrary commands on a targeted system. This can be exploited by convincing a user to follow a malicious link, which could cause the application to load libraries from a targeted directory. If an attacker can place a crafted library in an accessible directory, they could execute arbitrary commands with the privileges of the targeted user.

Recommendations For versions prior to 3.16.0.5505, update to version 3.16.0.5505 or later to resolve the issue.

Correção

Untrusted Search Path

Enumeração de Fraquezas

CWE-426

Identificadores relacionados

CVE-2019-13637

Produtos afetados

Join.Me

Referências · 3

• https://github.com/active-labs/Advisories/blob/master/ACTIVE-2019-009.md · Nota
• https://osv.dev/vulnerability/CVE-2019-13637 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-13637 · Nota de Segurança