Lucene search

MitreCVE-2019-11689

HistoryMar 18, 2020 - 3:15 p.m.

CVE-2019-11689

2020-03-1815:15:11

CWE-78

mitre

web.nvd.nist.gov

asustor

exfat driver

cve-2019-11689

code execution

root

validation bypass

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0.018

Percentile

88.4%

JSON

An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl fail to properly validate server responses and pass unsanitized text to the system shell, resulting in code execution as root.

Affected configurations

Nvd

Node

asustorexfat_driverMatch1.0.0r14

asustorexfat_driverMatch1.0.0r15

asustorexfat_driverMatch1.0.0r20

VendorProductVersionCPE
asustorexfat_driver1.0.0cpe:2.3:a:asustor:exfat_driver:1.0.0:r14:*:*:*:*:*:*
asustorexfat_driver1.0.0cpe:2.3:a:asustor:exfat_driver:1.0.0:r15:*:*:*:*:*:*
asustorexfat_driver1.0.0cpe:2.3:a:asustor:exfat_driver:1.0.0:r20:*:*:*:*:*:*

Vendor	Product	Version	CPE
asustor	exfat_driver	1.0.0	cpe:2.3:a:asustor:exfat_driver:1.0.0:r14::::::
asustor	exfat_driver	1.0.0	cpe:2.3:a:asustor:exfat_driver:1.0.0:r15::::::
asustor	exfat_driver	1.0.0	cpe:2.3:a:asustor:exfat_driver:1.0.0:r20::::::

References

github.com/mikedamm/CVEs/blob/master/CVE-2019-11688.md

www.asustor.com/app_central/app_detail?id=776

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0.018

Percentile

88.4%

JSON

Related for CVE-2019-11689