CVE-2019-6737

· HIGHModified

← All CVEs

CVSS v3.1

8.8

EPSS

3.82%

Published

Jun 3, 2019

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of TIScript. The issue lies in the handling of the openFile method, which allows for an arbitrary file write with attacker controlled data. An attacker can leverage this vulnerability execute code in the context of the current process. Was ZDI-CAN-7247.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-356

Affected Products (1)

bitdefender · safepayvulnerable

References (4)

https://www.bitdefender.com/support/security-advisories/bitdefender-safepay-openfile-arbitrary-file-write-remote-code-execution-vulnerability/

Vendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-19-158/

Third Party AdvisoryVDB Entry

https://www.bitdefender.com/support/security-advisories/bitdefender-safepay-openfile-arbitrary-file-write-remote-code-execution-vulnerability/

Vendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-19-158/

Third Party AdvisoryVDB Entry

KEV Catalog EPSS Scores Vendors All CVEs