CVE-2018-19999

The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls that permit local users to bypass authentication in the application and execute code in the context of the Windows SYSTEM account, leading to privilege escalation. To exploit this vulnerability, an attacker must have local access the the host running Serv-U, and a Serv-U administrator have an active management console session.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://seclists.org/fulldisclosure/2019/May/46	Mailing List Third Party Advisory
https://www.themissinglink.com.au/security-advisories-cve-2018-19999	Broken Link
https://seclists.org/fulldisclosure/2019/May/46	Mailing List Third Party Advisory
https://www.themissinglink.com.au/security-advisories-cve-2018-19999	Broken Link

Configurations

Configuration 1 (hide)

cpe:2.3:a:solarwinds:serv-u_ftp_server:15.1.6.25:*:*:*:*:*:*:*

History

21 Nov 2024, 03:58

Type	Values Removed	Values Added
References	~~() https://seclists.org/fulldisclosure/2019/May/46 - Mailing List, Third Party Advisory~~	() https://seclists.org/fulldisclosure/2019/May/46 - Mailing List, Third Party Advisory
References	~~() https://www.themissinglink.com.au/security-advisories-cve-2018-19999 - Broken Link~~	() https://www.themissinglink.com.au/security-advisories-cve-2018-19999 - Broken Link

Information

Published : 2019-06-07 17:29

Updated : 2024-11-21 03:58

NVD link : CVE-2018-19999

Mitre link : CVE-2018-19999

CVE.ORG link : CVE-2018-19999

JSON object : View

Products Affected

solarwinds

serv-u_ftp_server

CWE

CWE-287

Improper Authentication

{"id": "CVE-2018-19999", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2019-06-07T17:29:00.787", "references": [{"url": "https://seclists.org/fulldisclosure/2019/May/46", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.themissinglink.com.au/security-advisories-cve-2018-19999", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "https://seclists.org/fulldisclosure/2019/May/46", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.themissinglink.com.au/security-advisories-cve-2018-19999", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls that permit local users to bypass authentication in the application and execute code in the context of the Windows SYSTEM account, leading to privilege escalation. To exploit this vulnerability, an attacker must have local access the the host running Serv-U, and a Serv-U administrator have an active management console session."}, {"lang": "es", "value": "La interfaz de administraci\u00f3n local en SolarWinds Serv-U FTP Server versi\u00f3n 15.1.6.25, presenta controles de acceso incorrectos que permiten a los usuarios locales omitir la autenticaci\u00f3n en la aplicaci\u00f3n y ejecutar c\u00f3digo en el contexto de la cuenta SYSTEM de Windows, lo que conlleva a la escalada de privilegios. Para explotar esta vulnerabilidad, un atacante debe tener acceso local al host que ejecuta Serv-U, y un administrador de Serv-U presenta una sesi\u00f3n de consola administrativa activa."}], "lastModified": "2024-11-21T03:58:58.237", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:solarwinds:serv-u_ftp_server:15.1.6.25:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "483CDDCE-52EB-4FF4-AE0C-136D012D75BA"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}