PT-2020-10065 · Reportexpress · Reportexpress Proplus

Eunsol Lee · Published 2020-06-29 · Updated 2020-07-07 · CVE-2019-19160

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Reportexpress ProPlus (affected versions not specified)

Description The issue allows for arbitrary code execution by inserting VBscript into the configure file (rxp). This can be achieved through the configuration file, potentially allowing malicious actions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-353

CWE-345

Related Identifiers

CVE-2019-19160

Affected Products

Reportexpress Proplus

References · 6

• http://cabsoftware.com:8080/HomePage2015A/html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19160 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19160 · Vendor Advisory
• https://t.me/cibsecurity/13107 · Telegram Post
• https://t.me/cvenotify/4701 · Telegram Post
• https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35474 · Note