« Volver al listado

CVE-2019-8459

Estado: ModificadaCrítica (9.8)—

Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without using quotes in the path. This can cause loading of a previously placed executable with a name similar to the parts of the path, instead of the intended one.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (6)

Checkpoint — Capsule Docs Standalone ClientCheckpoint — Endpoint Security ClientsCheckpoint — Endpoint Security Server PackageCheckpoint — Jumbo Hotfix FOR Endpoint Security ServerCheckpoint — Remote Access ClientsCheckpoint — Smartconsole FOR Endpoint Security Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-8459",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@checkpoint.com",
      "affectedData": [
        {
          "vendor": "Check Point",
          "product": "Check Point Endpoint Security Client for Windows, VPN blade",
          "versions": [
            {
              "status": "affected",
              "version": "before E80.83"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-06-20T17:15:10.707",
  "references": [
    {
      "url": "https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk124972#Resolved%20Issues",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@checkpoint.com"
    },
    {
      "url": "https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk124972#Resolved%20Issues",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@checkpoint.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-428"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-428"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without using quotes in the path. This can cause loading of a previously placed executable with a name similar to the parts of the path, instead of the intended one."
    },
    {
      "lang": "es",
      "value": "Check Point Endpoint Security Client para Windows, con el VPN blade, anterior a versión E80.83, inicia un proceso sin usar comillas en la ruta (path). Esto puede causar la carga de un ejecutable previamente colocado con un nombre similar a las partes de la path, en lugar de uno deseado."
    }
  ],
  "lastModified": "2026-06-17T02:42:02.160",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:checkpoint:jumbo_hotfix_for_endpoint_security_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "369F9CB7-A059-42A5-BA78-A80C64C24978",
              "versionEndExcluding": "r77.30"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:checkpoint:endpoint_security_server_package:*:*:*:*:gaia:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "34572CB5-A664-4901-B9E8-1FF840D9CCEF",
              "versionEndExcluding": "r77.30.03"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:checkpoint:smartconsole_for_endpoint_security_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FAFC0759-E7ED-4C82-94AA-9E150DEFB50B",
              "versionEndExcluding": "r77.30.03"
            },
            {
              "criteria": "cpe:2.3:a:checkpoint:smartconsole_for_endpoint_security_server:e80.83:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7614E411-B614-4E8F-8789-A0191018292E"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:checkpoint:endpoint_security_clients:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F97D8F59-C7EF-4797-ABBA-803043E7FFA8",
              "versionEndExcluding": "e80.83"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:checkpoint:remote_access_clients:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "987EBF1C-5FFF-4078-8021-6C80BE631D79",
              "versionEndExcluding": "e80.83"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:checkpoint:capsule_docs_standalone_client:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6AAAC4FF-BD33-4658-8813-B00D2918CBB0",
              "versionEndExcluding": "e80.82"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@checkpoint.com"
}