Lucene search

HpCVE-2019-18909

HistoryNov 22, 2019 - 10:15 p.m.

CVE-2019-18909

2019-11-2222:15:11

CWE-78

web.nvd.nist.gov

149

hp thinpro

vpn software

command injection

cve-2019-18909

nvd

CVSS2

7.7

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:S/C:C/I:C/A:C

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

51.2%

JSON

The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with root privileges.

Affected configurations

Nvd

Node

hpthinproMatch6.2

hpthinproMatch6.2.1

hpthinproMatch7.0

hpthinproMatch7.1

AND

linuxlinux_kernelMatch-

VendorProductVersionCPE
hpthinpro6.2cpe:2.3:o:hp:thinpro:6.2:*:*:*:*:*:*:*
hpthinpro6.2.1cpe:2.3:o:hp:thinpro:6.2.1:*:*:*:*:*:*:*
hpthinpro7.0cpe:2.3:o:hp:thinpro:7.0:*:*:*:*:*:*:*
hpthinpro7.1cpe:2.3:o:hp:thinpro:7.1:*:*:*:*:*:*:*
linuxlinux_kernel-cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
hp	thinpro	6.2	cpe:2.3:o:hp:thinpro:6.2:::::::*
hp	thinpro	6.2.1	cpe:2.3:o:hp:thinpro:6.2.1:::::::*
hp	thinpro	7.0	cpe:2.3:o:hp:thinpro:7.0:::::::*
hp	thinpro	7.1	cpe:2.3:o:hp:thinpro:7.1:::::::*
linux	linux_kernel	-	cpe:2.3:o:linux:linux_kernel:-:::::::*

CNA Affected

[
  {
    "product": "ThinPro Linux",
    "vendor": "HP",
    "versions": [
      {
        "status": "affected",
        "version": "6.2"
      },
      {
        "status": "affected",
        "version": "6.2.1"
      },
      {
        "status": "affected",
        "version": "7.0"
      },
      {
        "status": "affected",
        "version": "7.1"
      }
    ]
  }
]

References

packetstormsecurity.com/files/156907/HP-ThinPro-6.x-7.x-Citrix-Command-Injection.html

seclists.org/fulldisclosure/2020/Mar/39

support.hp.com/us-en/document/c06509350

CVSS2

7.7

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:S/C:C/I:C/A:C

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

51.2%

JSON

Related for CVE-2019-18909