High severity · published Aug 18, 2019
CVE-2019-15136
The Access Control plugin in eProsima Fast RTPS through 1.9.0 does not check partition permissions from remote participant connections, which can lead to policy bypass for a…
7.5
CVSS
1.4%
EPSS
No
On KEV
Description
The Access Control plugin in eProsima Fast RTPS through 1.9.0 does not check partition permissions from remote participant connections, which can lead to policy bypass for a secure Data Distribution Service (DDS) partition.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
Fast-rtps · Eprosima
through 1.9.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-15136
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-15136
Third Party Advisory
https://arxiv.org/abs/1908.05310
Patch
https://github.com/eProsima/Fast-RTPS/issues/443
More from Fast-rtps
7.5
CVE-2019-15137
The Access Control plugin in eProsima Fast RTPS through 1.9.0 allows fnmatch pattern matches with topic name strings (instead of the permission expressions themselves), which can…