CVE-2019-12174

hide.me before 2.4.4 on macOS suffers from a privilege escalation vulnerability in the connectWithExecutablePath:configFilePath:configFileName method of the me_hide_vpnhelper.Helper class in the me.hide.vpnhelper macOS privilege helper tool. This method takes user-supplied input and can be used to escalate privileges, as well as obtain the ability to run any application on the system in the root context.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://drive.google.com/open?id=1TwbjmE45gnWeYpFyH8kDU63P7u4IdPd2	Exploit Third Party Advisory
https://drive.google.com/open?id=1TwbjmE45gnWeYpFyH8kDU63P7u4IdPd2	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hide:hide.me:*:*:*:*:*:macos:*:*

History

21 Nov 2024, 04:22

Type	Values Removed	Values Added
References	~~() https://drive.google.com/open?id=1TwbjmE45gnWeYpFyH8kDU63P7u4IdPd2 - Exploit, Third Party Advisory~~	() https://drive.google.com/open?id=1TwbjmE45gnWeYpFyH8kDU63P7u4IdPd2 - Exploit, Third Party Advisory

Information

Published : 2019-07-08 14:15

Updated : 2024-11-21 04:22

NVD link : CVE-2019-12174

Mitre link : CVE-2019-12174

CVE.ORG link : CVE-2019-12174

JSON object : View

Products Affected

hide

hide.me

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2019-12174", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2019-07-08T14:15:10.287", "references": [{"url": "https://drive.google.com/open?id=1TwbjmE45gnWeYpFyH8kDU63P7u4IdPd2", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://drive.google.com/open?id=1TwbjmE45gnWeYpFyH8kDU63P7u4IdPd2", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "hide.me before 2.4.4 on macOS suffers from a privilege escalation vulnerability in the connectWithExecutablePath:configFilePath:configFileName method of the me_hide_vpnhelper.Helper class in the me.hide.vpnhelper macOS privilege helper tool. This method takes user-supplied input and can be used to escalate privileges, as well as obtain the ability to run any application on the system in the root context."}, {"lang": "es", "value": "hide.me anterior a versi\u00f3n 2.4.4 en macOS, sufre de una vulnerabilidad de escalada de privilegios en el m\u00e9todo connectWithExecutablePath:configFilePath:configFileName de la clase me_hide_vpnhelper.Helper en la herramienta auxiliar de privilegio de macOS me.hide.vpnhelper. Este m\u00e9todo toma la entrada suministrada por el usuario y se puede usar para escalar privilegios, as\u00ed como para obtener la capacidad de ejecutar cualquier aplicaci\u00f3n sobre el sistema en el contexto root."}], "lastModified": "2024-11-21T04:22:22.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hide:hide.me:*:*:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "3C74B992-8C55-46BD-B535-ADEF094D96E5", "versionEndExcluding": "2.4.4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}