Lucene search

[email protected]CVE-2019-3999

HistoryFeb 25, 2020 - 7:15 p.m.

CVE-2019-3999

2020-02-2519:15:11

CWE-78

[email protected]

web.nvd.nist.gov

112

cve-2019-3999

druva insync

windows client

security vulnerability

os command injection

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

53.3%

JSON

Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYSTEM privileges.

Affected configurations

NVD

Node

druvainsync_clientMatch6.5.0

AND

microsoftwindowsMatch-

CPENameOperatorVersion
druva:insync_clientdruva insync clienteq6.5.0

CPE	Name	Operator	Version
druva:insync_client	druva insync client	eq	6.5.0

CNA Affected

[
  {
    "product": "Druva inSync Windows Client",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "6.5.0"
      }
    ]
  }
]