High severity · published Jun 3, 2019
CVE-2019-6737
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34
8.8
CVSS
3.8%
EPSS
No
On KEV
Description
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of TIScript. The issue lies in the handling of the openFile method, which allows for an arbitrary file write with attacker controlled data. An attacker can leverage this vulnerability execute code in the context of the current process. Was ZDI-CAN-7247.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.8% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Safepay · Bitdefender
23.0.10.34 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-6737
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-6737
Vendor Advisory
https://www.bitdefender.com/support/security-advisories/bitdefender-safepay-openfile-arbitrary-file-write-remote-code-execution-vulnerability/
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-19-158/
More from Safepay
8.8
CVE-2019-6738
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34
8.8
CVE-2019-6736
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34
5.5
CVE-2020-15734
An Origin Validation Error vulnerability in Bitdefender Safepay allows an attacker to manipulate the browser's file upload capability into accessing other files in the same…