CVE-2019-11355

An issue was discovered in Poly (formerly Polycom) HDX 3.1.13. A feature exists that allows the creation of a server / client certificate, or the upload of the user certificate, on the administrator's page. The value received from the user is the factor value of a shell script on the equipment. By entering a special character (such as a single quote) in a CN or other CSR field, one can insert a command into a factor value. A system command can be executed as root.

CVSS v3 7.2 HIGH
CVSS v2.0 9.0 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 8.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://support.polycom.com/content/dam/polycom-support/global/documentation/hdx-3-1-14-advisory.pdf	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:polycom:hdx_system_software:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-03-12 21:15

Updated : 2023-12-10 13:27

NVD link : CVE-2019-11355

Mitre link : CVE-2019-11355

CVE.ORG link : CVE-2019-11355

JSON object : View

Products Affected

polycom

hdx_system_software

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2019-11355", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2020-03-12T21:15:12.780", "references": [{"url": "https://support.polycom.com/content/dam/polycom-support/global/documentation/hdx-3-1-14-advisory.pdf", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Poly (formerly Polycom) HDX 3.1.13. A feature exists that allows the creation of a server / client certificate, or the upload of the user certificate, on the administrator's page. The value received from the user is the factor value of a shell script on the equipment. By entering a special character (such as a single quote) in a CN or other CSR field, one can insert a command into a factor value. A system command can be executed as root."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Poly (antes Polycom) HDX versi\u00f3n 3.1.13. Existe una funcionalidad que permite la creaci\u00f3n de un certificado de servidor/cliente, o la carga del certificado de usuario, en la p\u00e1gina del administrador. El valor recibido del usuario es el valor del factor de un script de shell en el equipo. Mediante la introducci\u00f3n de un car\u00e1cter especial (tal y como una comilla simple) en un campo CN u otro CSR, puede ser insertado un comando en un valor del factor. Un comando de sistema puede ser ejecutado como root."}], "lastModified": "2020-03-18T18:57:50.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:polycom:hdx_system_software:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E79A1E6E-6526-4754-8613-D553001F99B8", "versionEndIncluding": "3.1.13"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}