CVE-2019-6329

🗓️ 25 Jun 2019 16:24:33Reported by hpType

cve🔗 web.nvd.nist.gov👁 154 Views🌐 WEB

HP Support Assistant 8.7.50 and earlier allows user to gain system privilege and allows unauthorized modification of directories or files. Note: Different vulnerability than CVE-2019-6328

Reporter	Title	Published	Views	Family All 11
GithubExploit	Exploit for CVE-2019-6329	13 Oct 201909:20	–	githubexploit
Circl	CVE-2019-6329	7 May 202423:33	–	circl
CNVD	HP Support Assistant elevation of privilege vulnerability (CNVD-2019-23306)	26 Jun 201900:00	–	cnvd
Cvelist	CVE-2019-6329	25 Jun 201916:24	–	cvelist
EUVD	EUVD-2019-15894	7 Oct 202500:30	–	euvd
Hewlett-Packard	HPSBGN03620 rev. 4 - HP Support Assistant Escalation of Privilege Vulnerability	23 Jun 201900:00	–	hp
Tenable Nessus	HP Support Assistant < 8.8 Multiple Vulnerabilities	19 Jul 201900:00	–	nessus
NVD	CVE-2019-6329	25 Jun 201917:15	–	nvd
OSV	CVE-2019-6329	25 Jun 201917:15	–	osv
Prion	Code injection	25 Jun 201917:15	–	prion

NVD

Node

hp support_assistantRange≤8.7.50

[
  {
    "product": "HP Support Assistant",
    "vendor": "HP",
    "versions": [
      {
        "status": "affected",
        "version": "Version 8.7.50 and lower"
      }
    ]
  }
]

Source	Link
securityfocus	www.securityfocus.com/bid/108891
support	www.support.hp.com/us-en/document/c06388027

Parameter	Position	Path	Description	CWE
*.xml	path	C:\ProgramData\Hewlett-Packard\HP Support Framework\Logs\Temp\HPSA\*.xml	Privilege escalation by abusing HPSAObjUtil8.AddTempLogsPermission to grant full control over log XML files in HPSA folder via a hardlink-based trigger.	CWE-269
hardlink.xml	path	C:\ProgramData\Hewlett-Packard\HP Support Framework\Logs\Temp\HPSA\*.xml	Privilege escalation by abusing HPSAObjUtil8.AddTempLogsPermission to grant full control over log XML files in HPSA folder via a hardlink-based trigger.	CWE-269

21 Nov 2024 04:46Current

7.6High risk

Vulners AI Score7.6

CVSS 27.2

CVSS 3.17.8

EPSS0.07056