PT-2019-4504 · Kaspersky · Kaspersky Security Cloud+5

Published 2019-11-25 · Updated 2019-12-12 · CVE-2019-15688

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus versions up to 2020 Kaspersky Internet Security versions up to 2020 Kaspersky Total Security versions up to 2020 Kaspersky Free Anti-Virus versions up to 2020 Kaspersky Small Office Security versions up to 2020 Kaspersky Security Cloud versions up to 2020

Description The web protection component of the affected Kaspersky products did not adequately inform the user about the threat of redirecting to an untrusted site, allowing for bypass. This issue is related to the use of open redirection, which can be exploited by a remote attacker to redirect the user to an arbitrary site.

Recommendations For Kaspersky Anti-Virus versions up to 2020, update the web protection component to a version that properly informs the user about potential threats. For Kaspersky Internet Security versions up to 2020, update the web protection component to a version that properly informs the user about potential threats. For Kaspersky Total Security versions up to 2020, update the web protection component to a version that properly informs the user about potential threats. For Kaspersky Free Anti-Virus versions up to 2020, update the web protection component to a version that properly informs the user about potential threats. For Kaspersky Small Office Security versions up to 2020, update the web protection component to a version that properly informs the user about potential threats. For Kaspersky Security Cloud versions up to 2020, update the web protection component to a version that properly informs the user about potential threats. As a temporary workaround, consider restricting access to untrusted sites until the issue is resolved.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2020-00364

CVE-2019-15688

Affected Products

Kaspersky Anti-Virus

Kaspersky Free Anti-Virus

Kaspersky Internet Security

Kaspersky Security Cloud

Kaspersky Small Office Security

Kaspersky Total Security

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-15688 · Security Note
• https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15688 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00364 · Security Note