// For flags

CVE-2019-19364

 

Severity Score

7.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A weak malicious user can escalate its privilege whenever CatalystProductionSuite.2019.1.exe (version 1.1.0.21) and CatalystBrowseSuite.2019.1.exe (version 1.1.0.21) installers run. The vulnerability is in the form of DLL Hijacking. The installers try to load DLLs that don’t exist from its current directory; by doing so, an attacker can quickly escalate its privileges.

Un usuario malintencionado débil puede escalar sus privilegios siempre que se ejecuten los instaladores CatalystProductionSuite.2019.1.exe (versión 1.1.0.21) y CatalystBrowseSuite.2019.1.exe (versión 1.1.0.21). La vulnerabilidad está en forma de secuestro de DLL. Los instaladores intentan cargar archivos DLL que no existen desde su directorio actual; Al hacerlo, un atacante puede escalar rápidamente sus privilegios.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-11-27 CVE Reserved
  • 2019-12-04 CVE Published
  • 2023-04-08 EPSS Updated
  • 2024-08-05 CVE Updated
  • 2024-08-05 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-427: Uncontrolled Search Path Element
CAPEC
References (1)
URL Tag Source
URL Date SRC
https://gist.github.com/Eli-Paz/482b514320009f3e76ea712cde3bc350 2024-08-05
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Sony
Search vendor "Sony"
 Catalyst Browse
Search vendor "Sony" for product "Catalyst Browse"
 <= 2019.1
Search vendor "Sony" for product "Catalyst Browse" and version " <= 2019.1"
-
Affected
Sony
Search vendor "Sony"
 Catalyst Production Suite
Search vendor "Sony" for product "Catalyst Production Suite"
 <= 2019.1
Search vendor "Sony" for product "Catalyst Production Suite" and version " <= 2019.1"
-
Affected