Vulnerability Details : CVE-2019-5916
Input validation issue in POWER EGG(Ver 2.0.1, Ver 2.02 Patch 3 and earlier, Ver 2.1 Patch 4 and earlier, Ver 2.2 Patch 7 and earlier, Ver 2.3 Patch 9 and earlier, Ver 2.4 Patch 13 and earlier, Ver 2.5 Patch 12 and earlier, Ver 2.6 Patch 8 and earlier, Ver 2.7 Patch 6 and earlier, Ver 2.7 Government Edition Patch 7 and earlier, Ver 2.8 Patch 6 and earlier, Ver 2.8c Patch 5 and earlier, Ver 2.9 Patch 4 and earlier) allows remote attackers to execute EL expression on the server via unspecified vectors.
Products affected by CVE-2019-5916
- cpe:2.3:a:d-circle:power_egg:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:d-circle:power_egg:2.0.2:patch3:*:*:*:*:*:*
- cpe:2.3:a:d-circle:power_egg:2.1:patch4:*:*:*:*:*:*
- cpe:2.3:a:d-circle:power_egg:2.2:patch7:*:*:*:*:*:*
- cpe:2.3:a:d-circle:power_egg:2.3:patch9:*:*:*:*:*:*
- cpe:2.3:a:d-circle:power_egg:2.4:patch13:*:*:*:*:*:*
- cpe:2.3:a:d-circle:power_egg:2.5:patch12:*:*:*:*:*:*
- cpe:2.3:a:d-circle:power_egg:2.6:patch8:*:*:*:*:*:*
- cpe:2.3:a:d-circle:power_egg:2.7:patch6:*:*:*:*:*:*
- cpe:2.3:a:d-circle:power_egg:2.7:patch7:*:*:government:*:*:*
- cpe:2.3:a:d-circle:power_egg:2.8:patch6:*:*:*:*:*:*
- cpe:2.3:a:d-circle:power_egg:2.8c:patch5:*:*:*:*:*:*
- cpe:2.3:a:d-circle:power_egg:2.9:patch4:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-5916
1.27%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 84 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-5916
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2019-5916
-
The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-5916
-
https://poweregg.d-circle.com/support/package/important/20190204_000780/
POWER EGG2.0製品における任意のコード実行の脆弱性につきまして | 重要なお知らせ | POWER EGG 3.0Vendor Advisory
-
http://jvn.jp/en/jp/JVN63860183/index.html
JVN#63860183: POWER EGG vulnerability where EL expression may be executedThird Party Advisory
Jump to