PT-2019-9933 · Uipath · Uipath Orchestrator

Published 2019-08-08 · Updated 2020-08-24 · CVE-2018-19855

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions UiPath Orchestrator versions prior to 2018.3.4

Description The issue allows CSV Injection, related to the Audit export, Robot log export, and Transaction log export features.

Recommendations For versions prior to 2018.3.4, update to version 2018.3.4 or later to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2018-19855

Affected Products

Uipath Orchestrator

References · 4

• 🔥 https://www2.deloitte.com/de/de/pages/risk/articles/uipath-orchestrator-csv-injection.html · Exploit
• https://uipath.com/product/release-notes · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19855 · Security Note
• https://osv.dev/vulnerability/CVE-2018-19855 · Vendor Advisory