Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-8459

Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without using quotes in the path. This can cause loading of a previously placed executable with a name similar to the parts of the path, instead of the intended one.

Published

2019-06-20T17:15:10.707

Last Modified

2024-11-21T04:49:56.717

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Secondary
    CWE-428
  • Type: Primary
    CWE-428
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application checkpoint jumbo_hotfix_for_endpoint_security_server < r77.30 Yes
Application checkpoint endpoint_security_server_package < r77.30.03 Yes
Application checkpoint smartconsole_for_endpoint_security_server < r77.30.03 Yes
Application checkpoint smartconsole_for_endpoint_security_server e80.83 Yes
Application checkpoint endpoint_security_clients < e80.83 Yes
Application checkpoint remote_access_clients < e80.83 Yes
Application checkpoint capsule_docs_standalone_client < e80.82 Yes
References