Vulnerability Details : CVE-2019-19164
dext5.ocx ActiveX Control in Dext5 Upload 5.0.0.112 and earlier versions contains a vulnerability that could allow remote files to be executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection.
Vulnerability category: Input validation
Products affected by CVE-2019-19164
- cpe:2.3:a:raonwiz:dext5:2.7:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-19164
0.43%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 74 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-19164
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST | |
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
KrCERT/CC |
CWE ids for CVE-2019-19164
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: vuln@krcert.or.kr (Secondary)
References for CVE-2019-19164
-
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35344
KrCERT/CC - KISA 인터넷 보호나라&KrCERTThird Party Advisory
-
http://www.dext5.com/page/support/notice_view.aspx?pSeq=23
DEXT5 - 웹 표준 접근성의 차세대 HTML5 솔루션Vendor Advisory
Jump to