« Volver al listado

CVE-2019-8286

Estado: ModificadaMedia (4.3)—

Information Disclosure in Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security versions up to 2019 could potentially disclose unique Product ID by forcing victim to visit a specially crafted webpage (for example, via clicking phishing link). Vulnerability has CVSS v3.0 base score 2.6

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

Kaspersky — Anti-virusKaspersky — Free Anti-virusKaspersky — Internet SecurityKaspersky — Small Office SecurityKaspersky — Total Security

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-8286",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "vulnerability@kaspersky.com",
      "affectedData": [
        {
          "vendor": "Kaspersky",
          "product": "Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security",
          "versions": [
            {
              "status": "affected",
              "version": "up to 2019"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-07-18T19:15:11.677",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/109300",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "vulnerability@kaspersky.com"
    },
    {
      "url": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#110719",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "vulnerability@kaspersky.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/109300",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#110719",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Information Disclosure in Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security versions up to 2019 could potentially disclose unique Product ID by forcing victim to visit a specially crafted webpage (for example, via clicking phishing link). Vulnerability has CVSS v3.0 base score 2.6"
    },
    {
      "lang": "es",
      "value": "La divulgación de información en Kaspersky Anti-Virus, Kaspersky Internet Security, las versiones de Kaspersky Total Security hasta 2019 podrían revelar una identificación de producto única al obligar a la víctima a visitar una página web especialmente diseñada (por ejemplo, haciendo clic en el enlace de phishing). La vulnerabilidad tiene CVSS v3.0 puntuación base 2.6"
    }
  ],
  "lastModified": "2026-06-17T02:41:48.637",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:kaspersky:anti-virus:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "809717AB-2B60-4242-90CB-AADA2DD4910A",
              "versionEndIncluding": "2019"
            },
            {
              "criteria": "cpe:2.3:a:kaspersky:free_anti-virus:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2122730F-0290-4649-A74B-88557E4BB960",
              "versionEndIncluding": "2019"
            },
            {
              "criteria": "cpe:2.3:a:kaspersky:internet_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AACC2371-3664-457F-9877-73B25D6300FA",
              "versionEndIncluding": "2019"
            },
            {
              "criteria": "cpe:2.3:a:kaspersky:small_office_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "466D54D7-44EE-4085-9314-F369B58575F0",
              "versionEndIncluding": "6.0"
            },
            {
              "criteria": "cpe:2.3:a:kaspersky:total_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F25C6C41-32B9-4263-8003-FAFAA542926B",
              "versionEndIncluding": "2019"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vulnerability@kaspersky.com"
}