Vulnerability Details CVE-2019-11230
In Avast Antivirus before 19.4, a local administrator can trick the product into renaming arbitrary files by replacing the Logs\Update.log file with a symlink. The next time the product attempts to write to the log file, the target of the symlink is renamed. This defect can be exploited to rename a critical product file (e.g., AvastSvc.exe), causing the product to fail to start on the next system restart.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 30.5%
CVSS Severity
CVSS v3 Score 4.4
CVSS v2 Score 3.6
Products affected by CVE-2019-11230
-
cpe:2.3:a:avast:antivirus:12.1.2272
-
cpe:2.3:a:avast:antivirus:12.2.2276
-
cpe:2.3:a:avast:antivirus:12.3.2279
-
cpe:2.3:a:avast:antivirus:17.1.2286
-
cpe:2.3:a:avast:antivirus:17.2.2288
-
cpe:2.3:a:avast:antivirus:17.3.2290
-
cpe:2.3:a:avast:antivirus:17.3.2291
-
cpe:2.3:a:avast:antivirus:17.4.2294
-
cpe:2.3:a:avast:antivirus:17.5.2302
-
cpe:2.3:a:avast:antivirus:17.6.2310
-
cpe:2.3:a:avast:antivirus:17.7.2314
-
cpe:2.3:a:avast:antivirus:17.8.2318
-
cpe:2.3:a:avast:antivirus:17.9.2322
-
cpe:2.3:a:avast:antivirus:18.1.2326
-
cpe:2.3:a:avast:antivirus:18.2.2328
-
cpe:2.3:a:avast:antivirus:18.3.2333
-
cpe:2.3:a:avast:antivirus:18.4.2338
-
cpe:2.3:a:avast:antivirus:18.5.2342
-
cpe:2.3:a:avast:antivirus:18.6.2349
-
cpe:2.3:a:avast:antivirus:18.7.2354
-
cpe:2.3:a:avast:antivirus:18.8.2356
-
cpe:2.3:a:avast:antivirus:19.1
-
cpe:2.3:a:avast:antivirus:19.3.2369
-
cpe:2.3:a:avast:antivirus:8.0.1489
-
cpe:2.3:a:avast:antivirus:8.0.1497
-
cpe:2.3:a:avast:antivirus:8.0.1500
-
cpe:2.3:a:avast:antivirus:8.0.1501
-
cpe:2.3:a:avast:antivirus:8.0.1504
-
cpe:2.3:a:avast:antivirus:8.0.1506