Vulnerability Description
The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with root privileges.
CVSS Score
8.0
HIGH
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hp | Thinpro | 6.2 |
| Linux | Linux Kernel | - |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/156907/HP-ThinPro-6.x-7.x-Citrix-Command-InExploitThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2020/Mar/39Mailing ListThird Party Advisory
- https://support.hp.com/us-en/document/c06509350Vendor Advisory
- http://packetstormsecurity.com/files/156907/HP-ThinPro-6.x-7.x-Citrix-Command-InExploitThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2020/Mar/39Mailing ListThird Party Advisory
- https://support.hp.com/us-en/document/c06509350Vendor Advisory
FAQ
What is CVE-2019-18909?
CVE-2019-18909 is a vulnerability with a CVSS score of 8.0 (HIGH). The VPN software within HP ThinPro does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with root privileges.
How severe is CVE-2019-18909?
CVE-2019-18909 has been rated HIGH with a CVSS base score of 8.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-18909?
Check the references section above for vendor advisories and patch information. Affected products include: Hp Thinpro, Linux Linux Kernel.