CVE-2019-15131
In Code42 Enterprise 6.7.5 and earlier, 6.8.4 through 6.8.8, and 7.0.0 a vulnerability has been identified that may allow arbitrary files to be uploaded to Code42 servers and executed.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.88%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In Code42 Enterprise 6.7.5 and earlier, 6.8.4 through 6.8.8, and 7.0.0 a vulnerability has been identified that may allow arbitrary files to be uploaded to Code42 servers and executed. This vulnerability could allow an attacker to create directories and save files on Code42 servers, which could potentially lead to code execution.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.88% probability · 78th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-434
- Affected
- code42/code42
- Source
- cve@mitre.org
References
- https://code42.com/r/support/CVE-2019-15131Vendor Advisory
- https://support.code42.com/Terms_and_conditions/Code42_customer_support_resources/Code42_security_advisoriesVendor Advisory
- https://code42.com/r/support/CVE-2019-15131Vendor Advisory
- https://support.code42.com/Terms_and_conditions/Code42_customer_support_resources/Code42_security_advisoriesVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.