PT-2020-10069 · Dext5 · Dext5 Upload

Donghyun + 1 · Published 2020-05-07 · Updated 2021-10-29 · CVE-2019-19164

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dext5 Upload versions 5.0.0.112 and earlier

Description The issue allows remote files to be executed by setting the arguments to the ActiveX method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection.

Recommendations For versions 5.0.0.112 and earlier, consider disabling the ActiveX control until a patch is available to prevent remote file execution. Restrict access to the dext5.ocx ActiveX Control to minimize the risk of exploitation. Avoid using the affected ActiveX method in web pages until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2019-19164

Affected Products

Dext5 Upload

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-19164 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19164 · Vendor Advisory
• http://dext5.com/page/support/notice_view.aspx?pSeq=23 · Vendor Advisory
• https://t.me/cvenotify/3626 · Telegram Post
• https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35344 · Note
• https://t.me/cibsecurity/11930 · Telegram Post