PT-2019-4443 · Hewlett Packard · Hp Touchpoint Analytics

Peleg Hadar · Published 2019-10-04 · Updated 2020-08-24 · CVE-2019-6333

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP Touchpoint Analytics versions prior to 4.1.4.2827

Description A potential security issue has been identified that may allow a local attacker with administrative privileges to execute arbitrary code via an HP Touchpoint Analytics system service. The issue is related to insufficient input validation, which can be exploited by an attacker to execute malicious code using DLL files. This can lead to a privilege escalation.

Recommendations For versions prior to 4.1.4.2827, update to version 4.1.4.2827 or later to resolve the issue. As a temporary workaround, consider restricting access to the HP Touchpoint Analytics system service to minimize the risk of exploitation. Additionally, avoid using malicious DLL files in the affected system.

Fix

RCE

Uncontrolled Search Path Element

Weakness Enumeration

CWE-20

CWE-427

Related Identifiers

BDU:2020-00216

CVE-2019-6333

Affected Products

Hp Touchpoint Analytics

References · 12

• https://bdu.fstec.ru/vul/2020-00216 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-6333 · Security Note
• https://osv.dev/vulnerability/CVE-2019-6333 · Vendor Advisory
• https://support.hp.com/us-en/document/c06463166 · Vendor Advisory
• https://support.hp.com/ru-ru/document/c06464632 · Note
• https://t.me/secharvester/7683 · Telegram Post
• https://t.me/canyoupwnme/6036 · Telegram Post
• https://t.me/rnetsec/10629 · Telegram Post
• https://t.me/defcon_news/26939 · Telegram Post
• https://safebreach.com/Post/HP-Touchpoint-Analytics-DLL-Search-Order-Hijacking-Potential-Abuses-CVE-2019-6333 · Note
• https://techtoday.in.ua/ru/news-ru/hp-tayno-ustanavlivaet-shpiona-hp-touchpoint-analytics-84603.html · Note
• https://t.me/sysadm_in_channel/1164 · Telegram Post