High severity · published Oct 4, 2019
CVE-2019-11655
Unrestricted file upload vulnerability in Micro Focus ArcSight Logger, version 6.7.0 and later
8.8
CVSS
1.5%
EPSS
No
On KEV
Description
Unrestricted file upload vulnerability in Micro Focus ArcSight Logger, version 6.7.0 and later. This vulnerability could allow Unrestricted Upload of File with Dangerous type.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AL
Arcsight Logger · HP
6.7.0 and later · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-11655
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-11655
community.microfocus.com
https://community.microfocus.com/t5/ArcSight-Announcements/ArcSight-Logger-Fix-for-Security-Vulnerability/td-p/2699569
More from Arcsight Logger
9.8
CVE-2019-3479
Mitigates a potential remote code execution issue in ArcSight Logger versions prior to 6.7
7.8
CVE-2019-3484
Mitigates a remote code execution issue in ArcSight Logger versions prior to 6.7
7.3
CVE-2015-6863
HPE ArcSight Logger before 6.1P1 allows remote attackers to execute arbitrary code via unspecified input to the (1) Intellicus or (2) client-certificate upload component
7.1
CVE-2019-3481
Mitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7
6.5
CVE-2019-3483
Mitigates a potential information leakage issue in ArcSight Logger versions prior to 6.7