Vulnerability Intelligence Report
CVE-2019-18780
An arbitrary command injection vulnerability in the Cluster Server component of Veritas InfoScale allows an unauthenticated remote attacker to execute arbitrary commands as root or administrator. These Veritas products are affected: Access 7.4.2 and earlier, Access Appliance 7.4.2 and earlier, Flex Appliance 1.2 and earlier, InfoScale 7.3.1 and earlier, InfoScale between 7.4.0 and 7.4.1, Veritas Cluster Server (VCS) 6.2.1 and earlier on Linux/UNIX, Veritas Cluster Server (VCS) 6.1 and earlier on Windows, Storage Foundation HA (SFHA) 6.2.1 and earlier on Linux/UNIX, and Storage Foundation HA (SFHA) 6.1 and earlier on Windows.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
EPSS Probability:6.14%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| veritas | access | all |
| veritas | access_appliance | all |
| veritas | flex_appliance | all |
| veritas | infoscale | all |
| veritas | cluster_server | all |
| veritas | storage_foundation_ha | all |
| microsoft | windows | all |
| linux | linux_kernel | all |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
6.138%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2019-11-05T00:00:00 |
| Published | 2019-11-05T19:05:17 |
| Last Updated | 2024-08-05T02:02:39 |
Community Chatter & Buzz