1. Home
  2. CVE Database
  3. CVE-2019-16305
HIGH · 8.8

CVE-2019-16305

In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection. A crafted link can trigger a popup asking whether the user wants to run MobaXterm to handle the link. If accepted, ...

Vulnerability Description

In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection. A crafted link can trigger a popup asking whether the user wants to run MobaXterm to handle the link. If accepted, another popup appears asking for further confirmation. If this is also accepted, command execution is achieved, as demonstrated by the MobaXterm://`calc` URI.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
MobatekMobaxterm11.1
MicrosoftWindows-

Related Weaknesses (CWE)

CWE-77

References

FAQ

What is CVE-2019-16305?

CVE-2019-16305 is a vulnerability with a CVSS score of 8.8 (HIGH). In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection. A crafted link can trigger a popup asking whether the user wants to run MobaXterm to handle the link. If accepted, ...

How severe is CVE-2019-16305?

CVE-2019-16305 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-16305?

Check the references section above for vendor advisories and patch information. Affected products include: Mobatek Mobaxterm, Microsoft Windows.