CVE-2019-12162

Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code execution or local privilege escalation by replacing the original update.exe.

CVSS v3 7.8 HIGH
CVSS v2.0 4.6 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://support.upwork.com/hc/en-us/categories/360001180954	Product Vendor Advisory
https://vuldb.com/?id.138406	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:upwork:time_tracker:5.2.2.716:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-07-23 15:15

Updated : 2023-12-10 12:59

NVD link : CVE-2019-12162

Mitre link : CVE-2019-12162

CVE.ORG link : CVE-2019-12162

JSON object : View

Products Affected

upwork

time_tracker

CWE

CWE-494

Download of Code Without Integrity Check

{"id": "CVE-2019-12162", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2019-07-23T15:15:11.040", "references": [{"url": "https://support.upwork.com/hc/en-us/categories/360001180954", "tags": ["Product", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://vuldb.com/?id.138406", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-494"}]}], "descriptions": [{"lang": "en", "value": "Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code execution or local privilege escalation by replacing the original update.exe."}, {"lang": "es", "value": "Upwork Time Tracker versi\u00f3n 5.2.2.716, no comprueba el hash SHA256 de la actualizaci\u00f3n del programa descargado antes de ejecutarlo, lo que podr\u00eda conllevar a la ejecuci\u00f3n de c\u00f3digo o la escalada de privilegios locales mediante el reemplazo del archivo update.exe original."}], "lastModified": "2020-08-24T17:37:01.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:upwork:time_tracker:5.2.2.716:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6EF5420E-524F-4A82-9E87-248DD78072E0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}