Privilege Manipulation in Micro Focus Data Protector
CVE-2019-11660

7.8HIGH

Key Information:

Vendor

Microfocus
Status
Data Protector
Vendor
CVE Published:
13 September 2019

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 28%

What is CVE-2019-11660?

This vulnerability allows a low-privileged user to exploit Micro Focus Data Protector by executing a custom binary with elevated privileges. The flaw exists across various versions of the product, providing an avenue for users with insufficient permissions to gain unauthorized access to critical functionalities. Users are advised to apply updates promptly to mitigate the risk associated with this security flaw.

Affected Version(s)

Data Protector 10.00, 10.01, 10.02, 10.03, 10.04, 10.10, 10.20, 10.30, 10.40

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2019-11660
Created by Rapid7

References

https://softwaresupport.softwaregrp.com/doc/KM03525630
x_refsource_CONFIRM
http://packetstormsecurity.com/files/155076/Micro-Focus-H...
x_refsource_MISC

EPSS Score

28% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.