PT-2019-14004 · Code42 · Code42 Enterprise

Published 2019-09-17 · Updated 2019-09-17 · CVE-2019-15131

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Code42 Enterprise versions 6.7.5 and earlier Code42 Enterprise versions 6.8.4 through 6.8.8 Code42 Enterprise version 7.0.0

Description A vulnerability has been identified that may allow arbitrary files to be uploaded to Code42 servers and executed, potentially leading to code execution. This issue could enable an attacker to create directories and save files on Code42 servers.

Recommendations For Code42 Enterprise versions 6.7.5 and earlier, update to a version later than 6.7.5 to resolve the issue. For Code42 Enterprise versions 6.8.4 through 6.8.8, update to a version later than 6.8.8 to resolve the issue. For Code42 Enterprise version 7.0.0, update to a version later than 7.0.0 to resolve the issue.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-15131

Affected Products

Code42 Enterprise

References · 4

• https://osv.dev/vulnerability/CVE-2019-15131 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15131 · Security Note
• https://code42.com/r/support/CVE-2019-15131 · Vendor Advisory
• https://support.code42.com/Terms_and_conditions/Code42_customer_support_resources/Code42_security_advisories · Vendor Advisory