High severity · published Aug 18, 2019
CVE-2019-15137
The Access Control plugin in eProsima Fast RTPS through 1.9.0 allows fnmatch pattern matches with topic name strings (instead of the permission expressions themselves), which can…
7.5
CVSS
1.3%
EPSS
No
On KEV
Description
The Access Control plugin in eProsima Fast RTPS through 1.9.0 allows fnmatch pattern matches with topic name strings (instead of the permission expressions themselves), which can lead to unintended connections between participants in a Data Distribution Service (DDS) network.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
Fast-rtps · Eprosima
through 1.9.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-15137
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-15137
Third Party Advisory
https://arxiv.org/abs/1908.05310
Patch
https://github.com/eProsima/Fast-RTPS/issues/441
More from Fast-rtps
7.5
CVE-2019-15136
The Access Control plugin in eProsima Fast RTPS through 1.9.0 does not check partition permissions from remote participant connections, which can lead to policy bypass for a…