Code42 up to 6.7.4/6.8.7/6.9.4 Configuration File Injection privilege escalation

A vulnerability has been found in Code42 Enterprise and Crashplan for Small Business Client up to 6.7.4/6.8.7/6.9.4 and classified as critical. Affected by this vulnerability is some unknown processing of the component Configuration File Handler. The manipulation with an unknown input leads to a privilege escalation vulnerability (Injection). The CWE definition for the vulnerability is CWE-269. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was released 07/19/2019. The advisory is shared at support.code42.com. This vulnerability is known as CVE-2019-11552 since 04/25/2019. Neither technical details nor an exploit are publicly available.

Upgrading to version 6.7.5, 6.8.8 or 6.9.4 eliminates this vulnerability.

Vendor

• Code42

Name

• Enterprise and Crashplan for Small Business Client

• 🔒
• 🔒
• 🔒

• 🔒
• 🔒
• 🔒

VulDB Meta Base Score: 5.5
VulDB Meta Temp Score: 5.3

VulDB Base Score: ≈5.5
VulDB Temp Score: ≈5.3
VulDB Vector: 🔒
VulDB Reliability: 🔍

VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Class: Privilege escalation / Injection (CWE-269)
Local: Yes
Remote: No

Availability: 🔒
Status: Not defined

Price Prediction: 🔍
Current Price Estimation: 🔒

Threat Intelligenceinfoedit

Threat: 🔍
Adversaries: 🔍
Geopolitics: 🔍
Economy: 🔍
Predictions: 🔍
Remediation: 🔍Recommended: Upgrade
Status: 🔍

0-Day Time: 🔒

Upgrade: Enterprise and Crashplan for Small Business Client 6.7.5/6.8.8/6.9.4

04/25/2019 CVE assigned
07/19/2019 +85 days Advisory disclosed
07/20/2019 +1 days VulDB entry created
07/20/2019 +0 days VulDB last updateAdvisory: support.code42.com

CVE: CVE-2019-11552 (🔒)

Created: 07/20/2019 08:41 AM
Complete: 🔍

Comments

Comments are closed.