FKIE_CVE-2019-18956

Vulnerability from fkie_nvd - Published: 2019-12-17 16:15 - Updated: 2026-06-17 02:25
Severity
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Divisa Proxia Suite 9 < 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 < 10.0.32, and 10.1 < 10.1.5, SparkSpace 1.0 < 1.0.30, 1.1 < 1.1.2, and 1.2 < 1.2.4, and Proxia PHR 1.0 < 1.0.30 and 1.1 < 1.1.2 allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a seria1.0lized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a serialized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. Affected products include Proxia Premium Edition 2017 and Sparkspace.
References
cve@mitre.orghttps://github.com/blackarrowsec/advisories/tree/master/2019/CVE-2019-18956Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/blackarrowsec/advisories/tree/master/2019/CVE-2019-18956Exploit, Third Party Advisory
Impacted products
Vendor Product Version
divisait dv2eemvc *
divisait dv2eemvc *
divisait dv2eemvc *
divisait dv2eemvc *
divisait dv2eemvc *
divisait dv2eemvc *
divisait dv2eemvc *
divisait dv2eemvc *
divisait proxia_phr *
divisait proxia_phr *
divisait proxia_suite *
divisait proxia_suite *
divisait proxia_suite *
divisait sparkspace *
divisait sparkspace *
divisait sparkspace *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:divisait:dv2eemvc:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B3C58238-03F8-4FB0-A0ED-E8C569E4D88C",
              "versionEndIncluding": "17-147",
              "versionStartIncluding": "17-62",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:divisait:dv2eemvc:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C23C9A04-A63C-487C-B418-C3CC1E6A86E0",
              "versionEndExcluding": "18.6.42",
              "versionStartIncluding": "18.6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:divisait:dv2eemvc:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C61883C6-D24C-4E97-845E-871EC806E3AE",
              "versionEndExcluding": "19.0.13",
              "versionStartIncluding": "19.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:divisait:dv2eemvc:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E81028E4-A47B-40B8-A50C-3F04E004F283",
              "versionEndExcluding": "19.1.19",
              "versionStartIncluding": "19.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:divisait:dv2eemvc:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7811339E-82E2-4B56-A8FE-B88CDD9AEC60",
              "versionEndExcluding": "19.2.41",
              "versionStartIncluding": "19.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:divisait:dv2eemvc:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9BA963C6-EA80-4FB9-A98A-B347C1DA35F9",
              "versionEndExcluding": "19.3.37",
              "versionStartIncluding": "19.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:divisait:dv2eemvc:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "303CD9A0-A47A-401E-867C-069420480FF9",
              "versionEndExcluding": "19.4.13",
              "versionStartIncluding": "19.4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:divisait:dv2eemvc:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F2C0C267-CC55-4CFF-BA82-A1E9E41751B1",
              "versionEndExcluding": "20.0.13",
              "versionStartIncluding": "20.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:divisait:proxia_phr:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AA38CC0E-C9FD-4C79-B5B0-34DC8D4231A3",
              "versionEndExcluding": "1.0.30",
              "versionStartIncluding": "1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:divisait:proxia_phr:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B66E1BB9-281A-41D5-8ED9-7E1D3CF80013",
              "versionEndExcluding": "1.1.2",
              "versionStartIncluding": "1.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:divisait:proxia_suite:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1DDCEB8-0C09-4520-9A32-BEFD67ABC143",
              "versionEndExcluding": "9.12.16",
              "versionStartIncluding": "9.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:divisait:proxia_suite:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF2673F9-C5DC-48A4-921A-108F5D2834D1",
              "versionEndExcluding": "10.0.32",
              "versionStartIncluding": "10.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:divisait:proxia_suite:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B700ED35-1F04-4AD4-B350-16E67C108ADD",
              "versionEndExcluding": "10.1.5",
              "versionStartIncluding": "10.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:divisait:sparkspace:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3337D501-34FF-4739-B26B-B97955C041EA",
              "versionEndExcluding": "1.0.30",
              "versionStartIncluding": "1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:divisait:sparkspace:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0624FCCB-8DDC-439C-BF12-9F796A1DDCF2",
              "versionEndExcluding": "1.1.2",
              "versionStartIncluding": "1.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:divisait:sparkspace:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BC8C6029-1668-4109-9418-1E9B7B6C874A",
              "versionEndExcluding": "1.2.4",
              "versionStartIncluding": "1.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Divisa Proxia Suite 9 \u003c 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 \u003c 10.0.32, and 10.1 \u003c 10.1.5, SparkSpace 1.0 \u003c 1.0.30, 1.1 \u003c 1.1.2, and 1.2 \u003c 1.2.4, and Proxia PHR 1.0 \u003c 1.0.30 and 1.1 \u003c 1.1.2 allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a seria1.0lized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a serialized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. Affected products include Proxia Premium Edition 2017 and Sparkspace."
    },
    {
      "lang": "es",
      "value": "Divisa Proxia Suite versiones 9 anteriores a las versiones  9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 y 9.7.10, versiones 10.0 anteriores a la versi\u00f3n  10.0.32 y versiones 10.1 anteriores a la versi\u00f3n 10.1.5, SparkSpace versiones 1.0 anteriores a la versi\u00f3n  1.0.30, versiones 1.1 anteriores a la versi\u00f3n  1.1.2, y versiones 1.2 anteriores a la versi\u00f3n  1.2.4, y Proxia PHR versiones 1.0 anteriores a la versi\u00f3n  1.0.30 y versiones 1.1 anteriores a 1.1.2, permite una ejecuci\u00f3n de c\u00f3digo remota mediante la deserializaci\u00f3n de un Java no segura. La cookie proxia-error se deserializa de forma no segura en cada petici\u00f3n (GET o POST). Por lo tanto, un atacante no identificado puede crear f\u00e1cilmente una carga \u00fatil seria 1.0.0 para ejecutar c\u00f3digo arbitrario por medio de la funci\u00f3n prepareError en la clase com.divisait.dv2ee.controller.MVCControllerServlet del componente dv2eemvc.jar. permite la ejecuci\u00f3n de c\u00f3digo remota mediante la deserializaci\u00f3n de Java no segura. La cookie de error de proxia se deserializa de forma no segura en cada petici\u00f3n (GET o POST). Por lo tanto, un atacante no autenticado puede crear f\u00e1cilmente una carga \u00fatil serializada para ejecutar c\u00f3digo arbitrario por medio de la funci\u00f3n prepareError en la clase com.divisait.dv2ee.controller.MVCControllerServlet del componente dv2eemvc.jar. Los productos afectados incluyen Proxia Premium Edition 2017 y Sparkspace."
    }
  ],
  "id": "CVE-2019-18956",
  "lastModified": "2026-06-17T02:25:38.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-12-17T16:15:14.653",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/blackarrowsec/advisories/tree/master/2019/CVE-2019-18956"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/blackarrowsec/advisories/tree/master/2019/CVE-2019-18956"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.