CVE-2019-7281
Last modified
CVE-2019-7281 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Prima Systems FlexAir, Versions 2.3.38 and prior. An unauthenticated user can send unverified HTTP requests, which may allow the attacker to perform certain actions with administrative privileges if a logged-in user visits a malicious website.. EPSS estimates a 0.94% chance of exploitation in the next 30 days.
Description
Prima Systems FlexAir, Versions 2.3.38 and prior. An unauthenticated user can send unverified HTTP requests, which may allow the attacker to perform certain actions with administrative privileges if a logged-in user visits a malicious website.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Primasystems | Flexair | <= 2.3.38 |
References
- https://applied-risk.com/labs/advisoriesNot Applicable, Third Party Advisory
- https://www.applied-risk.com/resources/ar-2019-007Third Party Advisory
- https://www.us-cert.gov/ics/advisories/icsa-19-211-02Third Party Advisory, US Government Resource
- https://applied-risk.com/labs/advisoriesNot Applicable, Third Party Advisory
- https://www.applied-risk.com/resources/ar-2019-007Third Party Advisory
- https://www.us-cert.gov/ics/advisories/icsa-19-211-02Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-7281?
How severe is CVE-2019-7281?
How do I fix CVE-2019-7281?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-7275Optergy Proton/Enterprise devices allow Open Redirect.6.1
- CVE-2019-7276Optergy Proton/Enterprise devices allow Remote Root Code Exe…
- CVE-2019-7277Optergy Proton/Enterprise devices allow Unauthenticated Inte…
- CVE-2019-7278Optergy Proton/Enterprise devices have an Unauthenticated SM…
- CVE-2019-7279Optergy Proton/Enterprise devices have Hard-coded Credential…
- CVE-2019-7280Prima Systems FlexAir, Versions 2.3.38 and prior. The sessio…8.8
- CVE-2019-7282In NetKit through 0.17, rcp.c in the rcp client allows remot…5.9
- CVE-2019-7283An issue was discovered in rcp in NetKit through 0.17. For a…7.4
- CVE-2019-7284This issue was addressed with improved checks. This issue is…4.3
- CVE-2019-7285A use after free issue was addressed with improved memory ma…8.8
- CVE-2019-7286A memory corruption issue was addressed with improved input …7.8
- CVE-2019-7287A memory corruption issue was addressed with improved input …7.8
Are you affected by CVE-2019-7281?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST