CVE-2019-5029

🗓️ 13 Nov 2019 22:34:02Reported by talosType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 92 Views🌐 WEB

Command injection vulnerability in Exhibitor Web UI versions 1.0.9 to 1.7.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2019-5029	14 Dec 202300:02	–	circl
CNVD	Exhibitor Command Injection Vulnerability	14 Nov 201900:00	–	cnvd
Check Point Advisories	Soabase Exhibitor UI Config Command Injection (CVE-2019-5029)	16 Feb 202100:00	–	checkpoint_advisories
Cvelist	CVE-2019-5029	13 Nov 201922:34	–	cvelist
Exploit DB	Exhibitor Web UI 1.7.1 - Remote Code Execution	7 Jul 202000:00	–	exploitdb
NVD	CVE-2019-5029	13 Nov 201923:15	–	nvd
OpenVAS	Exhibitor 1.0.9 <= 1.7.1 RCE Vulnerability	26 Nov 201900:00	–	openvas
Prion	Command injection	13 Nov 201923:15	–	prion
RedhatCVE	CVE-2019-5029	5 Feb 202517:53	–	redhatcve
Talos	Exhibitor UI command injection vulnerability	13 Nov 201900:00	–	talos

NVD

Node

exhibitor_project exhibitorRange1.0.9–1.7.1

[
  {
    "product": "Exhibitor",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Tested version was compiled using the standalone pom.xml from the Exhibitor master branch"
      }
    ]
  }
]

Source	Link
talosintelligence	www.talosintelligence.com/vulnerability_reports/TALOS-2019-0790

Parameter	Position	Path	Description	CWE
javaEnvironment	request body	/exhibitor/v1/config/set	Command injection via the javaEnvironment field in the Exhibitor Web UI Config editor, allowing arbitrary shell commands to be executed when ZooKeeper is launched.	CWE-78

21 Nov 2024 04:44Current

9.7High risk

Vulners AI Score9.7

CVSS 3.19.8

CVSS 210

CVSS 39.8

EPSS0.88415

CWE-78