High severity · published Dec 2, 2019
CVE-2019-19020
An issue was discovered in TitanHQ WebTitan before 5.18
7.2
CVSS
2.3%
EPSS
No
On KEV
Description
An issue was discovered in TitanHQ WebTitan before 5.18. In the administration web interface it is possible to upload a crafted backup file that enables an attacker to execute arbitrary code by overwriting existing files or adding new PHP files under the web root. This requires the attacker to have access to a valid web interface account.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webtitan · Titanhq
before 5.18 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-19020
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-19020
Exploit
https://write-up.github.io/webtitan/
Release Notes
https://www.webtitan.com/resources/product-updates/
More from Webtitan
9.8
CVE-2019-19021
An issue was discovered in TitanHQ WebTitan before 5.18
9.8
CVE-2019-19015
An issue was discovered in TitanHQ WebTitan before 5.18
8.1
CVE-2019-19017
An issue was discovered in TitanHQ WebTitan before 5.18
7.8
CVE-2019-19014
An issue was discovered in TitanHQ WebTitan before 5.18
7.5
CVE-2019-19019
An issue was discovered in TitanHQ WebTitan before 5.18