Lucene search

MitreCVE-2019-8385

HistoryJun 05, 2019 - 7:29 p.m.

CVE-2019-8385

2019-06-0519:29:00

CWE-22

mitre

web.nvd.nist.gov

thomson reuters

desktop extensions

cve-2019-8385

directory traversal

local file inclusion

vulnerability

sam

system

remote code execution

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.103

Percentile

95.0%

JSON

An issue was discovered in Thomson Reuters Desktop Extensions 1.9.0.358. An unauthenticated directory traversal and local file inclusion vulnerability in the ThomsonReuters.Desktop.Service.exe and ThomsonReuters.Desktop.exe allows a remote attacker to list or enumerate sensitive contents of files via a .. to port 6677. Additionally, this could allow for privilege escalation by dumping the affected machine’s SAM and SYSTEM database files, as well as remote code execution.

Affected configurations

Nvd

Node

thomsonreutersconcourse_matter_roomRange<2.13.0098

thomsonreutersfirm_central_desktopRange<2.13.0098

VendorProductVersionCPE
thomsonreutersconcourse_matter_room*cpe:2.3:a:thomsonreuters:concourse_matter_room:*:*:*:*:*:*:*:*
thomsonreutersfirm_central_desktop*cpe:2.3:a:thomsonreuters:firm_central_desktop:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
thomsonreuters	concourse_matter_room	*	cpe:2.3:a:thomsonreuters:concourse_matter_room::::::::
thomsonreuters	firm_central_desktop	*	cpe:2.3:a:thomsonreuters:firm_central_desktop::::::::

References

packetstormsecurity.com/files/152298/Thomson-Reuters-Concourse-And-Firm-Central-Local-File-Inclusion-Directory-Traversal.html

www.thomsonreuters.com/en/products-services.html

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.103

Percentile

95.0%

JSON

Related for CVE-2019-8385