Strix
26.1K

CVE-2019-13063

HIGHCVSS 7.5/10EPSS 27.23%

Last modified

CVE-2019-13063 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the script parameter on the Script_view page. This will result in file disclosure (i.e., being able to pull any file from the remote victim application). EPSS estimates a 27.23% chance of exploitation in the next 30 days.

Description

Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the script parameter on the Script_view page. This will result in file disclosure (i.e., being able to pull any file from the remote victim application). This can be used to steal and obtain sensitive config and other files. This can result in complete compromise of the application. The script parameter is vulnerable to directory traversal and both local and remote file inclusion.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Probability
27.23%

97.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
SahiproSahi Pro8.0.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2019-13063?
Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the script parameter on the Script_view page. This will result in file disclosure (i.e., being able to pull any file from the remote victim application). This can be used to steal and obtain sensitive config and other files. This can result in complete compromise of the application. The script parameter is vulnerable to directory traversal and both local and remote file inclusion.
How severe is CVE-2019-13063?
CVE-2019-13063 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 27.23% probability of exploitation in the next 30 days.
How do I fix CVE-2019-13063?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-13063?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST