« Volver al listado

CVE-2018-8790

Estado: ModificadaAlta (7.8)—

Check Point ZoneAlarm version 15.3.064.17729 and below expose a WCF service that can allow a local low privileged user to execute arbitrary code as SYSTEM.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Checkpoint — Zonealarm

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-8790",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@checkpoint.com",
      "affectedData": [
        {
          "vendor": "Check Point Software Technologies Ltd.",
          "product": "ZoneAlarm",
          "versions": [
            {
              "status": "affected",
              "version": "prior to version 15.3.064.17729"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-03-01T16:29:00.247",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/107254",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@checkpoint.com"
    },
    {
      "url": "https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk142952",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@checkpoint.com"
    },
    {
      "url": "https://www.zonealarm.com/software/release-history/zafavfw.html#15.4.062.17802",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@checkpoint.com"
    },
    {
      "url": "https://www.zonealarm.com/software/release-history/zafree.html#15.4.062.17802",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@checkpoint.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/107254",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk142952",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.zonealarm.com/software/release-history/zafavfw.html#15.4.062.17802",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.zonealarm.com/software/release-history/zafree.html#15.4.062.17802",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@checkpoint.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Check Point ZoneAlarm version 15.3.064.17729 and below expose a WCF service that can allow a local low privileged user to execute arbitrary code as SYSTEM."
    },
    {
      "lang": "es",
      "value": "Check Point ZoneAlarm, en versiones 15.3.064.17729 y anteriores, expone un servicio WCF que puede permitir que un usuario local con pocos privilegios ejecute código arbitrario como SYSTEM."
    }
  ],
  "lastModified": "2026-06-17T02:05:23.670",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:checkpoint:zonealarm:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3F5046F-F263-4BA0-ABA7-2CD0274169EF",
              "versionEndIncluding": "15.3.064.17729"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@checkpoint.com"
}