CVE-2019-6453

Опубликовано: 18 фев. 2019

Источник: nvd

CVSS3: 8.1

CVSS2: 6.8

EPSS Высокий

Описание

mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers. The attacker can specify an irc:// URI that loads an arbitrary .ini file from a UNC share pathname. Exploitation depends on browser-specific URI handling (Chrome is not exploitable).

Ссылки

https://github.com/proofofcalc/cve-2019-6453-poc
Exploit
Third Party Advisory
https://proofofcalc.com/advisories/20190218.txt
Third Party Advisory
https://proofofcalc.com/cve-2019-6453-mIRC/
Exploit
Third Party Advisory
https://twitter.com/proofofcalc/status/1097518413143003136
Exploit
Third Party Advisory
https://www.exploit-db.com/exploits/46392/
Exploit
Third Party Advisory
VDB Entry
https://www.mirc.com/news.html
Product
https://github.com/proofofcalc/cve-2019-6453-poc
Exploit
Third Party Advisory
https://proofofcalc.com/advisories/20190218.txt
Third Party Advisory
https://proofofcalc.com/cve-2019-6453-mIRC/
Exploit
Third Party Advisory
https://twitter.com/proofofcalc/status/1097518413143003136
Exploit
Third Party Advisory
https://www.exploit-db.com/exploits/46392/
Exploit
Third Party Advisory
VDB Entry
https://www.mirc.com/news.html
Product

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:mirc:mirc:*:*:*:*:*:*:*:*

Версия до 7.55 (исключая)

EPSS

Процентиль: 99%

0.84944

Высокий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-88

Связанные уязвимости

GHSA-95vj-g5cr-7j53