Vulnerability Details CVE-2018-19234
The Miss Marple Updater Service in COMPAREX Miss Marple Enterprise Edition before 2.0 allows remote attackers to execute arbitrary code with SYSTEM privileges via vectors related to missing update validation.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.033
EPSS Ranking 86.9%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 9.0
References
- http://packetstormsecurity.com/files/150427/Miss-Marple-Enterprise-Edition-File-Upload-Hardcoded-AES-Key.html
- http://seclists.org/fulldisclosure/2018/Nov/55
- https://seclists.org/bugtraq/2018/Nov/37
- https://www.sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-miss-marple-enterprise-edition/
- http://packetstormsecurity.com/files/150427/Miss-Marple-Enterprise-Edition-File-Upload-Hardcoded-AES-Key.html
- http://seclists.org/fulldisclosure/2018/Nov/55
- https://seclists.org/bugtraq/2018/Nov/37
- https://www.sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-miss-marple-enterprise-edition/
Products affected by CVE-2018-19234
-
cpe:2.3:a:comparex:miss_marple:*