1. Home
  2. CVE Database
  3. CVE-2019-19470
HIGH · 7.8

CVE-2019-19470

Unsafe usage of .NET deserialization in Named Pipe message processing allows privilege escalation to NT AUTHORITY\SYSTEM for a local attacker. Affected product is TinyWall, all versions up to and incl...

Vulnerability Description

Unsafe usage of .NET deserialization in Named Pipe message processing allows privilege escalation to NT AUTHORITY\SYSTEM for a local attacker. Affected product is TinyWall, all versions up to and including 2.1.12. Fixed in version 2.1.13.

CVSS Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
TinywallTinywall< 2.1.13

Related Weaknesses (CWE)

CWE-502

References

FAQ

What is CVE-2019-19470?

CVE-2019-19470 is a vulnerability with a CVSS score of 7.8 (HIGH). Unsafe usage of .NET deserialization in Named Pipe message processing allows privilege escalation to NT AUTHORITY\SYSTEM for a local attacker. Affected product is TinyWall, all versions up to and incl...

How severe is CVE-2019-19470?

CVE-2019-19470 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-19470?

Check the references section above for vendor advisories and patch information. Affected products include: Tinywall Tinywall.