CVE-2019-12157

Опубликовано: 02 окт. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Низкий

Описание

In JetBrains UpSource versions before 2018.2 build 1293, there is credential disclosure via RPC commands.

Ссылки

https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
Vendor Advisory
https://blog.jetbrains.com/blog/2019/09/26/jetbrains-security-bulletin-q2-2019/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*

Версия до 2018.2.5 (исключая)

cpe:2.3:a:jetbrains:upsource:*:*:*:*:*:*:*:*

Версия до 2018.2 (включая)

cpe:2.3:a:jetbrains:upsource:2018.2:build_1013:*:*:*:*:*:*

cpe:2.3:a:jetbrains:upsource:2018.2:build_1141:*:*:*:*:*:*

cpe:2.3:a:jetbrains:upsource:2018.2:build_1154:*:*:*:*:*:*

cpe:2.3:a:jetbrains:upsource:2018.2:build_1291:*:*:*:*:*:*

EPSS

Процентиль: 0%

0.00004

Низкий

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-20

Связанные уязвимости

GHSA-g577-j3p2-xr2w

github

больше 3 лет назад

In JetBrains TeamCity versions before 2018.2.5 and UpSource versions before 2018.2 build 1293, improper validation of user input for one of the fields could lead to Command Injection.