« Volver al listado

CVE-2019-20456

Estado: ModificadaAlta (7.8)—

Goverlan Reach Console before 9.50, Goverlan Reach Server before 3.50, and Goverlan Client Agent before 9.20.50 have an Untrusted Search Path that leads to Command Injection and Local Privilege Escalation via DLL hijacking.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Goverlan — Client AgentGoverlan — Reach ConsoleGoverlan — Reach Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-20456",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.4,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-02-16T19:15:10.457",
  "references": [
    {
      "url": "https://www.goverlan.com/knowledge/article/security-advisory-govsa-2019-1028-1-local-privilege-escalation-2/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.goverlan.com/knowledge/article/security-advisory-govsa-2019-1028-1-local-privilege-escalation-2/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-426"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Goverlan Reach Console before 9.50, Goverlan Reach Server before 3.50, and Goverlan Client Agent before 9.20.50 have an Untrusted Search Path that leads to Command Injection and Local Privilege Escalation via DLL hijacking."
    },
    {
      "lang": "es",
      "value": "Goverlan Reach Console versiones anteriores a 9.50, Goverlan Reach Server versiones anteriores a 3.50 y Goverlan Client Agent versiones anteriores a 9.20.50,presenta una Ruta de Búsqueda No Confiable que conlleva a una Inyección de Comandos y una Escalada de Privilegios Locales por medio del secuestro de DLL."
    }
  ],
  "lastModified": "2026-06-17T02:30:29.163",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:goverlan:client_agent:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4E29DA2-1DD7-4236-B73F-6DE709CAB575",
              "versionEndExcluding": "9.20.50"
            },
            {
              "criteria": "cpe:2.3:a:goverlan:reach_console:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44E28B02-3E63-47E8-A303-F5B3BAA5E412",
              "versionEndExcluding": "9.50"
            },
            {
              "criteria": "cpe:2.3:a:goverlan:reach_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2639091D-09DC-4B41-87C9-C2EA4FD10F99",
              "versionEndExcluding": "3.50"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}