7.8
CVE-2019-12162
- EPSS 0.08%
- Veröffentlicht 23.07.2019 15:15:11
- Zuletzt bearbeitet 21.11.2024 04:22:20
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginUpwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code execution or local privilege escalation by replacing the original update.exe.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Upwork ≫ Time Tracker Version5.2.2.716
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.08% | 0.235 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.8 | 1.8 | 5.9 |
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 4.6 | 3.9 | 6.4 |
AV:L/AC:L/Au:N/C:P/I:P/A:P
|
CWE-494 Download of Code Without Integrity Check
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.