CVE-2019-8385

Опубликовано: 05 июн. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Средний

Описание

An issue was discovered in Thomson Reuters Desktop Extensions 1.9.0.358. An unauthenticated directory traversal and local file inclusion vulnerability in the ThomsonReuters.Desktop.Service.exe and ThomsonReuters.Desktop.exe allows a remote attacker to list or enumerate sensitive contents of files via a .. to port 6677. Additionally, this could allow for privilege escalation by dumping the affected machine's SAM and SYSTEM database files, as well as remote code execution.

Ссылки

http://packetstormsecurity.com/files/152298/Thomson-Reuters-Concourse-And-Firm-Central-Local-File-Inclusion-Directory-Traversal.html
Exploit
Third Party Advisory
VDB Entry
https://www.thomsonreuters.com/en/products-services.html
Vendor Advisory
http://packetstormsecurity.com/files/152298/Thomson-Reuters-Concourse-And-Firm-Central-Local-File-Inclusion-Directory-Traversal.html
Exploit
Third Party Advisory
VDB Entry
https://www.thomsonreuters.com/en/products-services.html
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:thomsonreuters:concourse_matter_room:*:*:*:*:*:*:*:*

Версия до 2.13.0098 (исключая)

cpe:2.3:a:thomsonreuters:firm_central_desktop:*:*:*:*:*:*:*:*

Версия до 2.13.0098 (исключая)

EPSS

Процентиль: 93%

0.107

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-22

Связанные уязвимости

GHSA-2f7w-8245-v7w6