PT-2019-12820 · Onapp · Onapp

Published 2019-06-19 · Updated 2020-08-24 · CVE-2019-12491

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OnApp versions prior to 5.0.0-88 OnApp versions prior to 5.5.0-93 OnApp versions prior to 6.0.0-196

Description The issue allows an attacker to run arbitrary commands with root privileges on servers managed by OnApp for XEN/KVM hypervisors. An attacker must have control of a single server on a given cloud, which can be achieved by renting one. From the source server, the attacker can craft any command and trigger the OnApp platform to execute that command with root privileges on a target server.

Recommendations For versions prior to 5.0.0-88, update to version 5.0.0-88 or later. For versions prior to 5.5.0-93, update to version 5.5.0-93 or later. For versions prior to 6.0.0-196, update to version 6.0.0-196 or later.

Fix

Related Identifiers

CVE-2019-12491

Affected Products

Onapp

References · 4

• https://osv.dev/vulnerability/CVE-2019-12491 · Vendor Advisory
• https://docs.onapp.com/rn/general-security-advisory · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12491 · Security Note
• https://skylightcyber.com/2019/06/07/all-your-cloud-are-belong-to-us-cve-2019-12491 · Note