PT-2021-9096 · Unknown · Versa Director

Published 2021-05-26 · Updated 2021-06-07 · CVE-2019-25029

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Versa Director (affected versions not specified)

Description The issue is related to command injection, where an attacker can execute arbitrary commands on the host operating system through a vulnerable application. This occurs when the application passes unsafe user-supplied data, such as forms, cookies, or HTTP headers, to a system shell. The attacker-supplied commands are executed with the privileges of the vulnerable application, and this is largely due to insufficient input validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2019-25029

Affected Products

Versa Director

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-25029 · Security Note
• https://hackerone.com/reports/1168198 · Note
• https://t.me/cvenotify/15695 · Telegram Post