« Volver al listado

CVE-2019-17327

Estado: ModificadaAlta (7.2)—

JEUS 7 Fix#0~5 and JEUS 8Fix#0~1 versions contains a directory traversal vulnerability caused by improper input parameter check when uploading installation file in administration web page. That leads remote attacker to execute arbitrary code via uploaded file.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Tmaxsoft — Jeus

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-17327",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "vuln@krcert.or.kr",
      "affectedData": [
        {
          "vendor": "TmaxSoft",
          "product": "JEUS",
          "versions": [
            {
              "status": "affected",
              "version": "JEUS 7 Fix#0~5, JEUS 8Fix#0~1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-11-08T18:15:13.467",
  "references": [
    {
      "url": "https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35197",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "vuln@krcert.or.kr"
    },
    {
      "url": "https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35197",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "JEUS 7 Fix#0~5 and JEUS 8Fix#0~1 versions contains a directory traversal vulnerability caused by improper input parameter check when uploading installation file in administration web page. That leads remote attacker to execute arbitrary code via uploaded file."
    },
    {
      "lang": "es",
      "value": "Las versiones JEUS 7 Fix#0~5 y JEUS 8 Fix#0~1, contienen una vulnerabilidad de salto de directorio causada por una comprobación inapropiada de los parámetros de entrada cuando se actualiza el archivo de instalación en la página web de administración. Esto conlleva al atacante remoto a ejecutar código arbitrario por medio del archivo cargado."
    }
  ],
  "lastModified": "2026-06-17T02:23:43.763",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tmaxsoft:jeus:7:fix_0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "30A1BF9A-C29E-420A-AF80-E6AAB1F54D91"
            },
            {
              "criteria": "cpe:2.3:a:tmaxsoft:jeus:7:fix_5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3EAD3E3A-BD44-4A40-B338-E2A0B73A11EC"
            },
            {
              "criteria": "cpe:2.3:a:tmaxsoft:jeus:8:fix_0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1B87C92-273A-43E5-AF78-E2E5F92AA4ED"
            },
            {
              "criteria": "cpe:2.3:a:tmaxsoft:jeus:8:fix_1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "394242F2-D8AF-420C-AFEC-C350F083B2E9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vuln@krcert.or.kr"
}