« Volver al listado

CVE-2019-6555

Estado: ModificadaAlta (7.8)—

Cscape, 9.80 SP4 and prior. An improper input validation vulnerability may be exploited by processing specially crafted POC files. This may allow an attacker to read confidential information and remotely execute arbitrary code.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Hornerautomation — Cscape

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-6555",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "ICS-CERT",
          "product": "Cscape",
          "versions": [
            {
              "status": "affected",
              "version": "9.80 SP4 and prior."
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-02-28T20:29:00.323",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/107087",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-050-03",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "http://www.securityfocus.com/bid/107087",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-050-03",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cscape, 9.80 SP4 and prior. An improper input validation vulnerability may be exploited by processing specially crafted POC files. This may allow an attacker to read confidential information and remotely execute arbitrary code."
    },
    {
      "lang": "es",
      "value": "Cscape en versiones 9.80 SP4 y anteriores. Una vulnerabilidad de validación de entradas incorrecta podría explotarse procesando archivos POC especialmente manipulados. Esto podría permitir a un atacante leer información confidencial y ejecutar código arbitrario de manera remota."
    }
  ],
  "lastModified": "2026-06-17T02:39:15.033",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hornerautomation:cscape:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5A89B25A-E4C8-4E56-AC04-D6C8174FE040",
              "versionEndExcluding": "9.80"
            },
            {
              "criteria": "cpe:2.3:a:hornerautomation:cscape:9.80:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB1A5B28-B735-474F-A217-79F542F2E132"
            },
            {
              "criteria": "cpe:2.3:a:hornerautomation:cscape:9.80:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "261E1F5A-11B3-4C4A-8F6F-0E3A2265C026"
            },
            {
              "criteria": "cpe:2.3:a:hornerautomation:cscape:9.80:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BB6A196-B017-40BB-A48A-57FCA46DCF9A"
            },
            {
              "criteria": "cpe:2.3:a:hornerautomation:cscape:9.80:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28736E2E-2E3F-4D7C-AC78-8F885424C06A"
            },
            {
              "criteria": "cpe:2.3:a:hornerautomation:cscape:9.80:sp4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59F63716-17B2-4065-A8B9-FEF300088B15"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}