« Volver al listado

CVE-2019-19100

Estado: ModificadaAlta (7.1)—

A privilege escalation vulnerability in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, < 4.3.11SP, < 4.4.9SP, < 4.5.4SP, <. 4.6.3SP, < 4.7.2 and < 4.8.1 allow authenticated users to delete arbitrary files via an exposed interface.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Br-automation — Automation Studio

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-19100",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cybersecurity@ch.abb.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 1.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cybersecurity@ch.abb.com",
      "affectedData": [
        {
          "vendor": "B&R",
          "product": "Automation Studio",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.x"
            },
            {
              "status": "affected",
              "version": "4.1.x"
            },
            {
              "status": "affected",
              "version": "4.2.x"
            },
            {
              "status": "affected",
              "version": "< 4.3.11SP"
            },
            {
              "status": "affected",
              "version": "< 4.4.9SP"
            },
            {
              "status": "affected",
              "version": "< 4.5.4SP"
            },
            {
              "status": "affected",
              "version": "< 4.6.3SP"
            },
            {
              "status": "affected",
              "version": "< 4.7.2"
            },
            {
              "status": "affected",
              "version": "< 4.8.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-04-29T03:15:16.503",
  "references": [
    {
      "url": "https://www.br-automation.com/en/downloads/032020-multiple-vulnerabilities-in-automation-studio/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cybersecurity@ch.abb.com"
    },
    {
      "url": "https://www.br-automation.com/en/downloads/032020-multiple-vulnerabilities-in-automation-studio/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cybersecurity@ch.abb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A privilege escalation vulnerability in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, < 4.3.11SP, < 4.4.9SP, < 4.5.4SP, <. 4.6.3SP, < 4.7.2 and < 4.8.1 allow authenticated users to delete arbitrary files via an exposed interface."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de escalada de privilegios en el servicio de actualización en  B&amp;R Automation Studio versiones 4.0.x, 4.1.x, 4.2.x, versiones anteriores a 4.3.11SP, versiones anteriores a 4.4.9SP, versiones anteriores a 4.5.4SP, versiones anteriores a 4.6.3SP, versiones anteriores a 4.7.2 y versiones anteriores a 4.8.1, permite a usuarios autenticados eliminar archivos arbitrarios por medio de una interfaz expuesta."
    }
  ],
  "lastModified": "2026-06-17T02:26:10.080",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:br-automation:automation_studio:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C66F8E7-1E05-4F25-9B9E-7E580CBE2ABA",
              "versionEndIncluding": "4.0.29.87",
              "versionStartIncluding": "4.0"
            },
            {
              "criteria": "cpe:2.3:a:br-automation:automation_studio:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B1DFEE8-D096-4181-A28A-8D9C0F494B6A",
              "versionEndIncluding": "4.1.17.113",
              "versionStartIncluding": "4.1"
            },
            {
              "criteria": "cpe:2.3:a:br-automation:automation_studio:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7FF85042-3F53-4BC2-BD29-36D2EA243918",
              "versionEndIncluding": "4.2.14.119",
              "versionStartIncluding": "4.2"
            },
            {
              "criteria": "cpe:2.3:a:br-automation:automation_studio:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7987D40F-C2E4-4649-821F-14B415D98A80",
              "versionEndExcluding": "4.3.11",
              "versionStartIncluding": "4.3"
            },
            {
              "criteria": "cpe:2.3:a:br-automation:automation_studio:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C18C4E6-1F62-46D6-93CD-12C53B0F9D06",
              "versionEndExcluding": "4.4.9",
              "versionStartIncluding": "4.4"
            },
            {
              "criteria": "cpe:2.3:a:br-automation:automation_studio:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CF9329FD-EF8C-4E9B-A4D8-9F254BDF2743",
              "versionEndExcluding": "4.5.4",
              "versionStartIncluding": "4.5"
            },
            {
              "criteria": "cpe:2.3:a:br-automation:automation_studio:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3DA6549E-636B-4AC5-A5BB-83C5B5173AC8",
              "versionEndExcluding": "4.6.3",
              "versionStartIncluding": "4.6"
            },
            {
              "criteria": "cpe:2.3:a:br-automation:automation_studio:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7046AEE9-A813-4407-8A69-F9FB140AD53C",
              "versionEndExcluding": "4.7.2",
              "versionStartIncluding": "4.7"
            },
            {
              "criteria": "cpe:2.3:a:br-automation:automation_studio:4.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC5BFBFA-FE70-448B-A045-F31DB396DC83"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cybersecurity@ch.abb.com"
}