CVE-2019-18956

{"id": "CVE-2019-18956", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-12-17T16:15:14.653", "references": [{"url": "https://github.com/blackarrowsec/advisories/tree/master/2019/CVE-2019-18956", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Divisa Proxia Suite 9 < 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 < 10.0.32, and 10.1 < 10.1.5, SparkSpace 1.0 < 1.0.30, 1.1 < 1.1.2, and 1.2 < 1.2.4, and Proxia PHR 1.0 < 1.0.30 and 1.1 < 1.1.2 allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a seria1.0lized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a serialized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. Affected products include Proxia Premium Edition 2017 and Sparkspace."}, {"lang": "es", "value": "Divisa Proxia Suite versiones 9 anteriores a las versiones 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 y 9.7.10, versiones 10.0 anteriores a la versi\u00f3n 10.0.32 y versiones 10.1 anteriores a la versi\u00f3n 10.1.5, SparkSpace versiones 1.0 anteriores a la versi\u00f3n 1.0.30, versiones 1.1 anteriores a la versi\u00f3n 1.1.2, y versiones 1.2 anteriores a la versi\u00f3n 1.2.4, y Proxia PHR versiones 1.0 anteriores a la versi\u00f3n 1.0.30 y versiones 1.1 anteriores a 1.1.2, permite una ejecuci\u00f3n de c\u00f3digo remota mediante la deserializaci\u00f3n de un Java no segura. La cookie proxia-error se deserializa de forma no segura en cada petici\u00f3n (GET o POST). Por lo tanto, un atacante no identificado puede crear f\u00e1cilmente una carga \u00fatil seria 1.0.0 para ejecutar c\u00f3digo arbitrario por medio de la funci\u00f3n prepareError en la clase com.divisait.dv2ee.controller.MVCControllerServlet del componente dv2eemvc.jar. permite la ejecuci\u00f3n de c\u00f3digo remota mediante la deserializaci\u00f3n de Java no segura. La cookie de error de proxia se deserializa de forma no segura en cada petici\u00f3n (GET o POST). Por lo tanto, un atacante no autenticado puede crear f\u00e1cilmente una carga \u00fatil serializada para ejecutar c\u00f3digo arbitrario por medio de la funci\u00f3n prepareError en la clase com.divisait.dv2ee.controller.MVCControllerServlet del componente dv2eemvc.jar. Los productos afectados incluyen Proxia Premium Edition 2017 y Sparkspace."}], "lastModified": "2020-01-08T19:23:09.553", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:divisait:dv2eemvc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B3C58238-03F8-4FB0-A0ED-E8C569E4D88C", "versionEndIncluding": "17-147", "versionStartIncluding": "17-62"}, {"criteria": "cpe:2.3:a:divisait:dv2eemvc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C23C9A04-A63C-487C-B418-C3CC1E6A86E0", "versionEndExcluding": "18.6.42", "versionStartIncluding": "18.6"}, {"criteria": "cpe:2.3:a:divisait:dv2eemvc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C61883C6-D24C-4E97-845E-871EC806E3AE", "versionEndExcluding": "19.0.13", "versionStartIncluding": "19.0"}, {"criteria": "cpe:2.3:a:divisait:dv2eemvc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E81028E4-A47B-40B8-A50C-3F04E004F283", "versionEndExcluding": "19.1.19", "versionStartIncluding": "19.1"}, {"criteria": "cpe:2.3:a:divisait:dv2eemvc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7811339E-82E2-4B56-A8FE-B88CDD9AEC60", "versionEndExcluding": "19.2.41", "versionStartIncluding": "19.2"}, {"criteria": "cpe:2.3:a:divisait:dv2eemvc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BA963C6-EA80-4FB9-A98A-B347C1DA35F9", "versionEndExcluding": "19.3.37", "versionStartIncluding": "19.3"}, {"criteria": "cpe:2.3:a:divisait:dv2eemvc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "303CD9A0-A47A-401E-867C-069420480FF9", "versionEndExcluding": "19.4.13", "versionStartIncluding": "19.4"}, {"criteria": "cpe:2.3:a:divisait:dv2eemvc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2C0C267-CC55-4CFF-BA82-A1E9E41751B1", "versionEndExcluding": "20.0.13", "versionStartIncluding": "20.0"}, {"criteria": "cpe:2.3:a:divisait:proxia_phr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AA38CC0E-C9FD-4C79-B5B0-34DC8D4231A3", "versionEndExcluding": "1.0.30", "versionStartIncluding": "1.0"}, {"criteria": "cpe:2.3:a:divisait:proxia_phr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B66E1BB9-281A-41D5-8ED9-7E1D3CF80013", "versionEndExcluding": "1.1.2", "versionStartIncluding": "1.1"}, {"criteria": "cpe:2.3:a:divisait:proxia_suite:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1DDCEB8-0C09-4520-9A32-BEFD67ABC143", "versionEndExcluding": "9.12.16", "versionStartIncluding": "9.0"}, {"criteria": "cpe:2.3:a:divisait:proxia_suite:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF2673F9-C5DC-48A4-921A-108F5D2834D1", "versionEndExcluding": "10.0.32", "versionStartIncluding": "10.0"}, {"criteria": "cpe:2.3:a:divisait:proxia_suite:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B700ED35-1F04-4AD4-B350-16E67C108ADD", "versionEndExcluding": "10.1.5", "versionStartIncluding": "10.1"}, {"criteria": "cpe:2.3:a:divisait:sparkspace:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3337D501-34FF-4739-B26B-B97955C041EA", "versionEndExcluding": "1.0.30", "versionStartIncluding": "1.0"}, {"criteria": "cpe:2.3:a:divisait:sparkspace:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0624FCCB-8DDC-439C-BF12-9F796A1DDCF2", "versionEndExcluding": "1.1.2", "versionStartIncluding": "1.1"}, {"criteria": "cpe:2.3:a:divisait:sparkspace:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC8C6029-1668-4109-9418-1E9B7B6C874A", "versionEndExcluding": "1.2.4", "versionStartIncluding": "1.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}