CVE-2019-12967: Stephan Mooltipass Moolticute through 0.42.1 (and possibly earlier versions) has Incorrect Access Control

Medium severity · published Oct 22, 2019

CVE-2019-12967

Stephan Mooltipass Moolticute through 0.42.1 (and possibly earlier versions) has Incorrect Access Control

6.5

CVSS

EPSS

On KEV

Description

Stephan Mooltipass Moolticute through 0.42.1 (and possibly earlier versions) has Incorrect Access Control.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.0% · higher than 62% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Moolticute · Themooltipass

through 0.42.1 · source: NVD

Affected product

Moolticute

Themooltipass

All Moolticute CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2019-12967

CVE.org

https://www.cve.org/CVERecord?id=CVE-2019-12967

Patch

https://github.com/mooltipass/moolticute/commits/master

Exploit

https://securiteam.io/2019/10/20/cve-2019-12967-moolticute-improper-access-control/