CVE-2019-18631 : The Windows component of Centrify Authentication and Privilege Elevation Services 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.5.0, 3.5

The Windows component of Centrify Authentication and Privilege Elevation Services 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.5.0, 3.5.1 (18.8), 3.5.2 (18.11), and 3.6.0 (19.6) does not properly handle an unspecified exception during use of partially trusted assemblies to serialize input data, which allows attackers to execute arbitrary code inside the Centrify process via (1) a crafted application that makes a pipe connection to the process and sends malicious serialized data or (2) a crafted Microsoft Management Console snap-in control file.

Published 2019-11-05 16:15:11

Updated 2021-09-13 10:52:51

Source MITRE

View at NVD, CVE.org

Vulnerability category: Execute code

Exploit prediction scoring system (EPSS) score for CVE-2019-18631

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 31 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-18631

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.1	MEDIUM	AV:N/AC:H/Au:N/C:P/I:P/A:P	4.9	6.4	NIST
Access Vector: Network Access Complexity: High Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

Products affected by CVE-2019-18631

Centrify » Authentication Service » Version: 3.4.0 For Windows
cpe:2.3:a:centrify:authentication_service:3.4.0:*:*:*:*:windows:*:*
Matching versions
When used together with: Centrify » Infrastructure Services » Version: 18.8
Centrify » Authentication Service » Version: 3.4.1 For Windows
cpe:2.3:a:centrify:authentication_service:3.4.1:*:*:*:*:windows:*:*
Matching versions
When used together with: Centrify » Infrastructure Services » Version: 18.8
Centrify » Authentication Service » Version: 3.4.2 For Windows
cpe:2.3:a:centrify:authentication_service:3.4.2:*:*:*:*:windows:*:*
Matching versions
When used together with: Centrify » Infrastructure Services » Version: 18.8
Centrify » Authentication Service » Version: 3.4.3 For Windows
cpe:2.3:a:centrify:authentication_service:3.4.3:*:*:*:*:windows:*:*
Matching versions
When used together with: Centrify » Infrastructure Services » Version: 18.8
Centrify » Authentication Service » Version: 3.5.0 For Windows
cpe:2.3:a:centrify:authentication_service:3.5.0:*:*:*:*:windows:*:*
Matching versions
When used together with: Centrify » Infrastructure Services » Version: 18.8
Centrify » Authentication Service » Version: 3.5.1 For Windows
cpe:2.3:a:centrify:authentication_service:3.5.1:*:*:*:*:windows:*:*
Matching versions
When used together with: Centrify » Infrastructure Services » Version: 18.8
Centrify » Authentication Service » Version: 3.5.2 For Windows
cpe:2.3:a:centrify:authentication_service:3.5.2:*:*:*:*:windows:*:*
Matching versions
When used together with: Centrify » Infrastructure Services » Version: 18.11
Centrify » Authentication Service » Version: 3.6.0 For Windows
cpe:2.3:a:centrify:authentication_service:3.6.0:*:*:*:*:windows:*:*
Matching versions
When used together with: Centrify » Infrastructure Services » Version: 19.6
Centrify » Privilege Elevation Service » Version: 3.4.0 For Windows
cpe:2.3:a:centrify:privilege_elevation_service:3.4.0:*:*:*:*:windows:*:*
Matching versions
When used together with: Centrify » Infrastructure Services » Version: 18.8
Centrify » Privilege Elevation Service » Version: 3.4.1 For Windows
cpe:2.3:a:centrify:privilege_elevation_service:3.4.1:*:*:*:*:windows:*:*
Matching versions
When used together with: Centrify » Infrastructure Services » Version: 18.8
Centrify » Privilege Elevation Service » Version: 3.4.2 For Windows
cpe:2.3:a:centrify:privilege_elevation_service:3.4.2:*:*:*:*:windows:*:*
Matching versions
When used together with: Centrify » Infrastructure Services » Version: 18.8
Centrify » Privilege Elevation Service » Version: 3.4.3 For Windows
cpe:2.3:a:centrify:privilege_elevation_service:3.4.3:*:*:*:*:windows:*:*
Matching versions
When used together with: Centrify » Infrastructure Services » Version: 18.8
Centrify » Privilege Elevation Service » Version: 3.5.0 For Windows
cpe:2.3:a:centrify:privilege_elevation_service:3.5.0:*:*:*:*:windows:*:*
Matching versions
When used together with: Centrify » Infrastructure Services » Version: 18.8
Centrify » Privilege Elevation Service » Version: 3.5.1 For Windows
cpe:2.3:a:centrify:privilege_elevation_service:3.5.1:*:*:*:*:windows:*:*
Matching versions
When used together with: Centrify » Infrastructure Services » Version: 18.8
Centrify » Privilege Elevation Service » Version: 3.5.2 For Windows
cpe:2.3:a:centrify:privilege_elevation_service:3.5.2:*:*:*:*:windows:*:*
Matching versions
When used together with: Centrify » Infrastructure Services » Version: 18.11
Centrify » Privilege Elevation Service » Version: 3.6.0 For Windows
cpe:2.3:a:centrify:privilege_elevation_service:3.6.0:*:*:*:*:windows:*:*
Matching versions
When used together with: Centrify » Infrastructure Services » Version: 19.6

Vulnerability Details : CVE-2019-18631

Exploit prediction scoring system (EPSS) score for CVE-2019-18631

CVSS scores for CVE-2019-18631

CWE ids for CVE-2019-18631

References for CVE-2019-18631

Products affected by CVE-2019-18631