« Back to list

CVE-2019-15131

Status: ModifiedCritical (9.8)—

In Code42 Enterprise 6.7.5 and earlier, 6.8.4 through 6.8.8, and 7.0.0 a vulnerability has been identified that may allow arbitrary files to be uploaded to Code42 servers and executed. This vulnerability could allow an attacker to create directories and save files on Code42 servers, which could potentially lead to code execution.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Code42 — Code42

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2019-15131",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-09-17T12:15:10.167",
  "references": [
    {
      "url": "https://code42.com/r/support/CVE-2019-15131",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://support.code42.com/Terms_and_conditions/Code42_customer_support_resources/Code42_security_advisories",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://code42.com/r/support/CVE-2019-15131",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.code42.com/Terms_and_conditions/Code42_customer_support_resources/Code42_security_advisories",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Code42 Enterprise 6.7.5 and earlier, 6.8.4 through 6.8.8, and 7.0.0 a vulnerability has been identified that may allow arbitrary files to be uploaded to Code42 servers and executed. This vulnerability could allow an attacker to create directories and save files on Code42 servers, which could potentially lead to code execution."
    },
    {
      "lang": "es",
      "value": "En Code42 Enterprise versión 6.7.5 y anteriores, versiones 6.8.4 hasta 6.8.8 y versión 7.0.0, ha sido identificada una vulnerabilidad que puede permitir que archivos arbitrarios sean cargados y ejecutados en los servidores de Code42. Esta vulnerabilidad podría permitir a un atacante crear directorios y guardar archivos en servidores Code42, lo que podría conllevar potencialmente a la ejecución de código."
    }
  ],
  "lastModified": "2026-06-17T02:19:45.703",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:code42:code42:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "26888583-9BF6-4EE3-8F59-C15CFBE371FF",
              "versionEndIncluding": "6.7.5"
            },
            {
              "criteria": "cpe:2.3:a:code42:code42:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB0CE390-6BCB-4A0E-8257-AD6480F2ABFE",
              "versionEndIncluding": "6.8.8",
              "versionStartIncluding": "6.8.4"
            },
            {
              "criteria": "cpe:2.3:a:code42:code42:7.0.0:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6B27735-D667-4A90-9D71-EDF8F38EB9B9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}