PT-2019-15090 · Tmaxsoft · Jeus

Published 2019-11-08 · Updated 2019-11-13 · CVE-2019-17327

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JEUS versions 7.0 through 7.5 JEUS versions 8.0 through 8.1

Description The issue is caused by an improper input parameter check when uploading an installation file in the administration web page, leading to a directory traversal vulnerability. This allows a remote attacker to execute arbitrary code via an uploaded file.

Recommendations For JEUS versions 7.0 through 7.5, update to a version that includes the fix for the directory traversal vulnerability. For JEUS versions 8.0 through 8.1, update to a version that includes the fix for the directory traversal vulnerability. As a temporary workaround, consider restricting access to the administration web page to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-17327

Affected Products

Jeus

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-17327 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17327 · Vendor Advisory
• https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35197 · Patch