CVE-2019-12725

{"id": "CVE-2019-12725", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-07-19T23:15:10.967", "references": [{"url": "http://packetstormsecurity.com/files/160211/ZeroShell-3.9.0-Remote-Command-Execution.html", "source": "cve@mitre.org"}, {"url": "http://packetstormsecurity.com/files/162561/ZeroShell-3.9.0-Remote-Command-Execution.html", "source": "cve@mitre.org"}, {"url": "https://www.tarlogic.com/advisories/zeroshell-rce-root.txt", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://zeroshell.org/blog/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters."}, {"lang": "es", "value": "Zeroshell versi\u00f3n 3.9.0, es propenso a una vulnerabilidad de ejecuci\u00f3n de comandos remota. Espec\u00edficamente, este problema ocurre porque la aplicaci\u00f3n web maneja inapropiadamente algunos par\u00e1metros HTTP. Un atacante no autenticado puede explotar este problema inyectando comandos del Sistema Operativo dentro de los par\u00e1metros vulnerables."}], "lastModified": "2021-05-13T18:15:08.463", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:zeroshell:zeroshell:3.9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5E5D41D1-AAF3-4B6B-BA20-7E7A5CC74826"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}