PT-2019-15845 · Saltosystem · Proaccess Space

Werner Schober · Publicado 2019-12-03 · Atualizado 2019-12-13 · CVE-2019-19460

Mitre

CVSS v2.0

6.6

Média

Vetor base

AV:L/AC:L/Au:N/C:N/I:C/A:C

An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. The product's webserver runs as a Windows service with local SYSTEM permissions by default. This is against the principle of least privilege. An attacker who is able to exploit CVE-2019-19458 or CVE-2019-19459 is basically able to write to every single path on the file system, because the webserver is running with the highest privileges available.

Exploit

Correção

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

CVE-2019-19460

Produtos afetados

Proaccess Space

Referências · 4

• 🔥 https://packetstormsecurity.com/files/155525/SALTO-ProAccess-SPACE-5.5-Traversal-File-Write-XSS-Bypass.html · Exploit
• 🔥 https://sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-salto-proaccess-space · Exploit
• https://osv.dev/vulnerability/CVE-2019-19460 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-19460 · Nota de Segurança