PT-2019-14614 · Opmantek · Open-Audit

Jack Cable · Published 2019-09-13 · Updated 2019-09-13 · CVE-2019-16293

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open-AudIT versions prior to 3.2.0

Description The issue allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a URL field in the Create Discoveries feature.

Recommendations For versions prior to 3.2.0, update to version 3.2.0 or later to resolve the issue.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-16293

Affected Products

Open-Audit

References · 3

• 🔥 https://community.opmantek.com/display/OA/Errata+-+3.1.2+Security+issue%2C+September+2019 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-16293 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16293 · Vendor Advisory