Vulnerability Details CVE-2018-19234
The Miss Marple Updater Service in COMPAREX Miss Marple Enterprise Edition before 2.0 allows remote attackers to execute arbitrary code with SYSTEM privileges via vectors related to missing update validation.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.054
EPSS Ranking 89.9%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 9.0
References
- http://packetstormsecurity.com/files/150427/Miss-Marple-Enterprise-Edition-File-Upload-Hardcoded-AES-Key.html
- http://seclists.org/fulldisclosure/2018/Nov/55
- https://seclists.org/bugtraq/2018/Nov/37
- https://www.sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-miss-marple-enterprise-edition/
- http://packetstormsecurity.com/files/150427/Miss-Marple-Enterprise-Edition-File-Upload-Hardcoded-AES-Key.html
- http://seclists.org/fulldisclosure/2018/Nov/55
- https://seclists.org/bugtraq/2018/Nov/37
- https://www.sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-miss-marple-enterprise-edition/
Products affected by CVE-2018-19234
-
cpe:2.3:a:comparex:miss_marple:*