PT-2019-13687 · Veritas · Veritas Resiliency Platform

David Dillard · Publicado 2019-07-29 · Atualizado 2023-03-03 · CVE-2019-14418

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AC:L/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N

Name of the Vulnerable Software and Affected Versions Veritas Resiliency Platform versions prior to 3.4 HF1

Description An issue allows a user with sufficient privileges to overwrite any file in the virtual machine through a directory traversal vulnerability when uploading an application bundle. This could enable a malicious user to replace existing files and take control of the virtual machine.

Recommendations For versions prior to 3.4 HF1, update to version 3.4 HF1 or later to resolve the issue. As a temporary workaround, consider restricting upload privileges to trusted users until the update is applied.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-14418

Produtos afetados

Veritas Resiliency Platform

Referências · 5

• http://seclists.org/fulldisclosure/2019/Jul/39 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-14418 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-14418 · Aviso do Fabricante
• http://packetstormsecurity.com/files/153842/Veritas-Resiliency-Platform-VRP-Traversal-Command-Execution.html · Nota
• https://veritas.com/content/support/en_US/security/VTS19-002.html#Issue1 · Aviso do Fabricante