Command Injection Vulnerability in MobaXterm by Mobatek
CVE-2019-16305

8.8HIGH

Key Information:

Vendor

Mobatek

Status
Mobaxterm
Vendor
CVE Published:
14 September 2019

What is CVE-2019-16305?

In versions 11.1 and 12.1 of MobaXterm, vulnerabilities exist in the protocol handler that allow for command injection. When a user clicks on a crafted link, they are prompted to open MobaXterm, and if they confirm this action, a second prompt appears for final approval. Accepting this second prompt may lead to executing arbitrary commands, posing significant security risks. This vulnerability highlights the importance of user caution when handling links that could exploit protocol handlers.

References

https://freetom.github.io/0day/2019/09/14/MobaXterm-comma...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2019-16305 : Command Injection Vulnerability in MobaXterm by Mobatek