Lucene search

[email protected]CVE-2019-5916

HistoryFeb 13, 2019 - 6:29 p.m.

CVE-2019-5916

2019-02-1318:29:01

CWE-917

[email protected]

web.nvd.nist.gov

cve-2019-5916

information security

input validation

power egg

remote attack

server

execution

el expression

vulnerability

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.013 Low

EPSS

Percentile

85.8%

JSON

Input validation issue in POWER EGG(Ver 2.0.1, Ver 2.02 Patch 3 and earlier, Ver 2.1 Patch 4 and earlier, Ver 2.2 Patch 7 and earlier, Ver 2.3 Patch 9 and earlier, Ver 2.4 Patch 13 and earlier, Ver 2.5 Patch 12 and earlier, Ver 2.6 Patch 8 and earlier, Ver 2.7 Patch 6 and earlier, Ver 2.7 Government Edition Patch 7 and earlier, Ver 2.8 Patch 6 and earlier, Ver 2.8c Patch 5 and earlier, Ver 2.9 Patch 4 and earlier) allows remote attackers to execute EL expression on the server via unspecified vectors.

Affected configurations

NVD

Node

d-circlepower_eggMatch2.0.1

d-circlepower_eggMatch2.0.2patch3

d-circlepower_eggMatch2.1patch4

d-circlepower_eggMatch2.2patch7

d-circlepower_eggMatch2.3patch9

d-circlepower_eggMatch2.4patch13

d-circlepower_eggMatch2.5patch12

d-circlepower_eggMatch2.6patch8

d-circlepower_eggMatch2.7patch6

d-circlepower_eggMatch2.7patch7government

d-circlepower_eggMatch2.8patch6

d-circlepower_eggMatch2.8cpatch5

d-circlepower_eggMatch2.9patch4

CPENameOperatorVersion
d-circle:power_eggd-circle power eggeq2.0.1
d-circle:power_eggd-circle power eggeq2.0.2
d-circle:power_eggd-circle power eggeq2.1
d-circle:power_eggd-circle power eggeq2.2
d-circle:power_eggd-circle power eggeq2.3
d-circle:power_eggd-circle power eggeq2.4
d-circle:power_eggd-circle power eggeq2.5
d-circle:power_eggd-circle power eggeq2.6
d-circle:power_eggd-circle power eggeq2.7
d-circle:power_eggd-circle power eggeq2.8

CPE	Name	Operator	Version
d-circle:power_egg	d-circle power egg	eq	2.0.1
d-circle:power_egg	d-circle power egg	eq	2.0.2
d-circle:power_egg	d-circle power egg	eq	2.1
d-circle:power_egg	d-circle power egg	eq	2.2
d-circle:power_egg	d-circle power egg	eq	2.3
d-circle:power_egg	d-circle power egg	eq	2.4
d-circle:power_egg	d-circle power egg	eq	2.5
d-circle:power_egg	d-circle power egg	eq	2.6
d-circle:power_egg	d-circle power egg	eq	2.7
d-circle:power_egg	d-circle power egg	eq	2.8

Rows per page:

1-10 of 121

CNA Affected

[
  {
    "product": "POWER EGG",
    "vendor": "D-CIRCLE inc.",
    "versions": [
      {
        "status": "affected",
        "version": "(Ver 2.0.1, Ver 2.02 Patch 3 and earlier, Ver 2.1 Patch 4 and earlier, Ver 2.2 Patch 7 and earlier, Ver 2.3 Patch 9 and earlier, Ver 2.4 Patch 13 and earlier, Ver 2.5 Patch 12 and earlier, Ver 2.6 Patch 8 and earlier, Ver 2.7 Patch 6 and earlier, Ver 2.7 Government Edition Patch 7 and earlier, Ver 2.8 Patch 6 and earlier, Ver 2.8c Patch 5 and earlier, Ver 2.9 Patch 4 and earlier)"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN63860183/index.html

poweregg.d-circle.com/support/package/important/20190204_000780/

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.013 Low

EPSS

Percentile

85.8%

JSON

Related for CVE-2019-5916

jvn1 prion1 cvelist1 nvd1