PT-2019-9111 · Expressvpn · Expressvpn

Publicado 2019-01-02 · Atualizado 2019-01-30 · CVE-2018-15490

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Média

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions ExpressVPN (affected versions not specified)

Description An issue was discovered in ExpressVPN on Windows, where the Xvpnd.exe process listens on TCP port 2015, using a JSON-RPC protocol over HTTP for communication with the client side of the application. The JSON-RPC XVPN.GetPreference and XVPN.SetPreference methods are vulnerable to path traversal, allowing reading and writing files on the file system on behalf of the service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-15490

Produtos afetados

Expressvpn

Referências · 3

• 🔥 https://medium.com/@Wflki/https-medium-com-wflki-cve-2018-15490-expressvpn-local-privilege-escalation-d22c86fecc47 · Exploit
• https://medium.com/%40Wflki/https-medium-com-wflki-cve-2018-15490-expressvpn-local-privilege-escalation-d22c86fecc47 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-15490 · Nota de Segurança