CVE-2019-19362

Severity Score

6.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows. (The vendor states that it was later fixed.) Upon login, every communication is saved within Windows main memory. When a user logs out or deletes conversation history (but does not exit the application), this data is not wiped from main memory, and therefore could be read by a local user with the same or greater privileges.

Se detectó un problema en la funcionalidad Chat de la aplicación de escritorio TeamViewer versión 14.3.4730 en Windows. (El proveedor declara que luego fue corregido). Tras iniciar sesión, cada comunicación es guardada en la memoria principal de Windows. Cuando un usuario cierra sesión o elimina el historial de conversación (pero no sale de la aplicación), estos datos no son borrados de la memoria principal y, por lo tanto, un usuario local puede leerlos con los mismos o mayores privilegios.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-11-27 CVE Reserved
2019-12-02 CVE Published
2023-03-08 EPSS Updated
2024-08-05 CVE Updated
2024-08-05 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC
http://nestedif.com/teamviewer-vulnerability-improper-session-handling-leading-to-information-disclosure-advisory	2024-08-05

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Teamviewer Search vendor "Teamviewer"	Teamviewer Search vendor "Teamviewer" for product "Teamviewer"	14.3.4730 Search vendor "Teamviewer" for product "Teamviewer" and version "14.3.4730"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe