VulnerabilityModified

CVE-2019-18956

CRITICAL 9.8EPSS 5.76%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (5.76%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Divisa Proxia Suite 9 < 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 < 10.0.32, and 10.1 < 10.1.5, SparkSpace 1.0 < 1.0.30, 1.1 < 1.1.2, and 1.2 < 1.2.4, and Proxia PHR 1.0 < 1.0.30 and 1.1 < 1.1.2 allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a seria1.0lized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a serialized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. Affected products include Proxia Premium Edition 2017 and Sparkspace.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 5.76% probability · 93th percentile
CISA KEV: Not listed
Weakness: CWE-502
Affected: divisait/dv2eemvc · divisait/proxia phr · divisait/proxia suite · divisait/sparkspace
Source: cve@mitre.org

References

https://github.com/blackarrowsec/advisories/tree/master/2019/CVE-2019-18956Exploit, Third Party Advisory
https://github.com/blackarrowsec/advisories/tree/master/2019/CVE-2019-18956Exploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.