« Volver al listado

CVE-2019-14418

Estado: ModificadaAlta (8.8)—

An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. When uploading an application bundle, a directory traversal vulnerability allows a VRP user with sufficient privileges to overwrite any file in the VRP virtual machine. A malicious VRP user could use this to replace existing files to take control of the VRP virtual machine.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Veritas — Resiliency Platform

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-14418",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.3
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-07-29T20:15:12.453",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/153842/Veritas-Resiliency-Platform-VRP-Traversal-Command-Execution.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2019/Jul/39",
      "tags": [
        "Broken Link",
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.veritas.com/content/support/en_US/security/VTS19-002.html#Issue1",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/153842/Veritas-Resiliency-Platform-VRP-Traversal-Command-Execution.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2019/Jul/39",
      "tags": [
        "Broken Link",
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.veritas.com/content/support/en_US/security/VTS19-002.html#Issue1",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. When uploading an application bundle, a directory traversal vulnerability allows a VRP user with sufficient privileges to overwrite any file in the VRP virtual machine. A malicious VRP user could use this to replace existing files to take control of the VRP virtual machine."
    },
    {
      "lang": "es",
      "value": "Se detectó un problema en Veritas Resiliencia Platform (VRP) anterior a versión 3.4 HF1. Cuando se carga un paquete de aplicaciones, una vulnerabilidad de salto de directorio permite a un usuario de VRP, con privilegios suficientes, sobrescribir cualquier archivo en la máquina virtual de VRP. Un usuario de VRP malicioso podría usar esto para reemplazar los archivos existentes y tomar el control de la máquina virtual de VRP."
    }
  ],
  "lastModified": "2026-06-17T02:18:24.210",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:veritas:resiliency_platform:1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AC19EBD5-492F-4A80-8F00-3B2B7BFBEE4C"
            },
            {
              "criteria": "cpe:2.3:a:veritas:resiliency_platform:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "654E26B2-7F5A-47BA-9CFA-028896976DFE"
            },
            {
              "criteria": "cpe:2.3:a:veritas:resiliency_platform:2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "265B7FDA-A146-4CB7-B230-25CBBD6D2A8C"
            },
            {
              "criteria": "cpe:2.3:a:veritas:resiliency_platform:2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9158833A-85AF-41B0-9552-6B1FB771EE02"
            },
            {
              "criteria": "cpe:2.3:a:veritas:resiliency_platform:2.2:update_3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "134E28FA-D293-48F9-BD42-C0A0CCA9F6F2"
            },
            {
              "criteria": "cpe:2.3:a:veritas:resiliency_platform:3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "41BC5DEF-D0AA-491C-BEFB-2C7EB42C64B0"
            },
            {
              "criteria": "cpe:2.3:a:veritas:resiliency_platform:3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4AA91579-BB67-4254-A9A0-5C646F932F16"
            },
            {
              "criteria": "cpe:2.3:a:veritas:resiliency_platform:3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9354073F-B0D8-4843-8DF7-3D70B0546627"
            },
            {
              "criteria": "cpe:2.3:a:veritas:resiliency_platform:3.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2D58398B-5F33-46F3-BD74-36E84503CC4C"
            },
            {
              "criteria": "cpe:2.3:a:veritas:resiliency_platform:3.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BF412FA-A2A3-4176-897A-D67E0AB98BBC"
            },
            {
              "criteria": "cpe:2.3:a:veritas:resiliency_platform:3.3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3AB0F86E-D59C-4A5B-8FE4-EA32DDDFA2F6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}