PT-2019-13457 · Logmein · Join.Me

Published 2019-07-17 · Updated 2020-08-24 · CVE-2019-13637

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LogMeIn join.me versions prior to 3.16.0.5505

Description The issue arises from unsafe search paths used by the application URI defined in Windows, allowing an attacker to execute arbitrary commands on a targeted system. This can be exploited by convincing a user to follow a malicious link, which could cause the application to load libraries from a targeted directory. If an attacker can place a crafted library in an accessible directory, they could execute arbitrary commands with the privileges of the targeted user.

Recommendations For versions prior to 3.16.0.5505, update to version 3.16.0.5505 or later to resolve the issue.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2019-13637

Affected Products

Join.Me

References · 3

• https://osv.dev/vulnerability/CVE-2019-13637 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13637 · Security Note
• https://github.com/active-labs/Advisories/blob/master/ACTIVE-2019-009.md · Note