PT-2019-12671 · Upwork · Upwork Time Tracker

Nathunandwani · Published 2019-07-23 · Updated 2020-08-24 · CVE-2019-12162

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Upwork Time Tracker version 5.2.2.716

Description The issue concerns the lack of verification of the SHA256 hash of downloaded program updates, potentially allowing code execution or local privilege escalation by replacing the original update.exe.

Recommendations For Upwork Time Tracker version 5.2.2.716, consider disabling automatic updates until a patch is available that properly verifies the integrity of updates before execution.

Fix

Weakness Enumeration

CWE-494

Related Identifiers

CVE-2019-12162

Affected Products

Upwork Time Tracker

References · 4

• https://osv.dev/vulnerability/CVE-2019-12162 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12162 · Security Note
• https://support.upwork.com/hc/en-us/categories/360001180954 · Vendor Advisory
• https://vuldb.com/?id.138406 · Note