high8.8
CVE-2018-19234
The Miss Marple Updater Service in COMPAREX Miss Marple Enterprise Edition before 2.0 allows remote attackers to execute arbitrary code with SYSTEM privileges …
Impact
The Miss Marple Updater Service in COMPAREX Miss Marple Enterprise Edition before 2.0 allows remote attackers to execute arbitrary code with SYSTEM privileges via vectors related to missing update validation.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Comparex | Miss Marple | before 2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/150427/Miss-Marple-Enterprise-Edition-File-Upload-Hardcoded-AES-Key.html
- http://seclists.org/fulldisclosure/2018/Nov/55
- https://seclists.org/bugtraq/2018/Nov/37
- https://www.sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-miss-marple-enterprise-edition/
- http://packetstormsecurity.com/files/150427/Miss-Marple-Enterprise-Edition-File-Upload-Hardcoded-AES-Key.html
- http://seclists.org/fulldisclosure/2018/Nov/55
- https://seclists.org/bugtraq/2018/Nov/37
- https://www.sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-miss-marple-enterprise-edition/