PT-2018-14884 · Comparex · Comparex Miss Marple Enterprise Edition

Marius Schwarz · Published 2018-12-20 · Updated 2019-01-08 · CVE-2018-19233

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions COMPAREX Miss Marple Enterprise Edition versions prior to 2.0

Description The issue allows local users to execute arbitrary code by reading the user name and encrypted password hard-coded in an Inventory Agent configuration file.

Recommendations For versions prior to 2.0, update to version 2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Inventory Agent configuration file to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2018-19233

Affected Products

Comparex Miss Marple Enterprise Edition

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-19233 · Security Note
• https://osv.dev/vulnerability/CVE-2018-19233 · Vendor Advisory
• https://sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-miss-marple-enterprise-edition · Note
• http://seclists.org/fulldisclosure/2018/Nov/55 · Note
• http://packetstormsecurity.com/files/150427/Miss-Marple-Enterprise-Edition-File-Upload-Hardcoded-AES-Key.html · Note
• https://seclists.org/bugtraq/2018/Nov/37 · Note