CVE-2019-15102
Last modified
CVE-2019-15102 is a vulnerability of currently unknown severity. An issue was discovered in Tyto Sahi Pro 6.x through 8.0.0. TestRunner_Non_distributed (and distributed end points) does not have any authentication mechanism. EPSS estimates a 3.85% chance of exploitation in the next 30 days.
Description
An issue was discovered in Tyto Sahi Pro 6.x through 8.0.0. TestRunner_Non_distributed (and distributed end points) does not have any authentication mechanism. This allow an attacker to execute an arbitrary script on the remote Sahi Pro server. There is also a password-protected web interface intended for remote access to scripts. This web interface lacks server-side validation, which allows an attacker to create/modify/delete a script remotely without any password. Chaining both of these issues results in remote code execution on the Sahi Pro server.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sahipro | Sahi Pro | >= 6.0.0, <= 8.0.0 |
References
- https://barriersec.com/2019/08/cve-2019-15102-sahi-pro/Exploit, Third Party Advisory
- https://barriersec.com/2019/08/cve-2019-15102-sahi-pro/Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-15102?
How severe is CVE-2019-15102?
How do I fix CVE-2019-15102?
Are you affected by CVE-2019-15102?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST