« Volver al listado

CVE-2019-9565

Estado: ModificadaCrítica (9.1)—

Druide Antidote RX, HD, 8 before 8.05.2287, 9 before 9.5.3937 and 10 before 10.1.2147 allows remote attackers to steal NTLM hashes or perform SMB relay attacks upon a direct launch of the product, or upon an indirect launch via an integration such as Chrome, Firefox, Word, Outlook, etc. This occurs because the product attempts to access a share with the PLUG-INS subdomain name; an attacker may be able to use Active Directory Domain Services to register that name.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Druide — Antidote

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-9565",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-03-04T08:29:00.497",
  "references": [
    {
      "url": "https://gosecure.net/2019/02/20/abusing-unsafe-defaults-in-active-directory/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.druide.com/en/news/security-improvement-antidote-windows",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://gosecure.net/2019/02/20/abusing-unsafe-defaults-in-active-directory/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.druide.com/en/news/security-improvement-antidote-windows",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Druide Antidote RX, HD, 8 before 8.05.2287, 9 before 9.5.3937 and 10 before 10.1.2147 allows remote attackers to steal NTLM hashes or perform SMB relay attacks upon a direct launch of the product, or upon an indirect launch via an integration such as Chrome, Firefox, Word, Outlook, etc. This occurs because the product attempts to access a share with the PLUG-INS subdomain name; an attacker may be able to use Active Directory Domain Services to register that name."
    },
    {
      "lang": "es",
      "value": "Druide Antidote RX y HD, en sus versiones 8 anteriores a la 8.05.2287, en las 9 anteriores a la 9.5.3937 y en las 10 anteriores a la 10.1.2147, permite a los atacantes remotos robar hashes NTLM o realizar ataques relay SMB durante un lanzamiento directo del producto o durante un lanzamiento indirecto mediante una integración como Chrome, Firefox, Word, Outlook, etc. Esto ocurre debido a que el producto intenta acceder a una compartición con el nombre de subdominio PLUG-INS. Un atacante podría usar los servicios de dominio de Active Directory para registrar dicho nombre."
    }
  ],
  "lastModified": "2026-06-17T02:43:57.467",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:druide:antidote:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4F5ADA2-50E7-46E5-B008-8A0F33DA816A",
              "versionEndExcluding": "8.05.2287",
              "versionStartIncluding": "8.0"
            },
            {
              "criteria": "cpe:2.3:a:druide:antidote:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B948EC3-3996-465A-A625-647495593C2D",
              "versionEndExcluding": "9.5.3937",
              "versionStartIncluding": "9.0"
            },
            {
              "criteria": "cpe:2.3:a:druide:antidote:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C059B36-D826-4F54-BAC5-06C53210AFEF",
              "versionEndExcluding": "10.1.2147",
              "versionStartIncluding": "10.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}