CVE-2019-12532 (GCVE-0-2019-12532)
Vulnerability from cvelistv5 – Published: 2019-08-26 17:06 – Updated: 2024-08-04 23:24
VLAI
EPSS
VEX
Summary
Improper access control in the Insyde software tools may allow an authenticated user to potentially enable escalation of privilege, or information disclosure via local access. This is a software vulnerability, not a firmware issue. Affected tools include: H2OFFT version 3.02~5.28, 100.00.00.00~100.00.08.23 and 200.00.00.01~200.00.00.05, H2OOAE before version 200.00.00.02, H2OSDE before version 200.00.00.07, H2OUVE before version 200.00.02.02, H2OPCM before version 100.00.06.00, H2OELV before version 100.00.02.08.
Severity
7.8 (High)
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://eclypsium.com/2019/08/10/screwed-drivers-… | x_refsource_MISC |
| https://www.insyde.com/security-pledge/SA-2019001 | x_refsource_CONFIRM |
| https://security.netapp.com/advisory/ntap-2022022… | x_refsource_CONFIRM |
Date Public
2019-08-12 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T23:24:38.523Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://eclypsium.com/2019/08/10/screwed-drivers-signed-sealed-delivered/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.insyde.com/security-pledge/SA-2019001"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20220223-0004/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-08-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper access control in the Insyde software tools may allow an authenticated user to potentially enable escalation of privilege, or information disclosure via local access. This is a software vulnerability, not a firmware issue. Affected tools include: H2OFFT version 3.02~5.28, 100.00.00.00~100.00.08.23 and 200.00.00.01~200.00.00.05, H2OOAE before version 200.00.00.02, H2OSDE before version 200.00.00.07, H2OUVE before version 200.00.02.02, H2OPCM before version 100.00.06.00, H2OELV before version 100.00.02.08."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-23T17:06:21.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://eclypsium.com/2019/08/10/screwed-drivers-signed-sealed-delivered/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.insyde.com/security-pledge/SA-2019001"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security.netapp.com/advisory/ntap-20220223-0004/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-12532",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Improper access control in the Insyde software tools may allow an authenticated user to potentially enable escalation of privilege, or information disclosure via local access. This is a software vulnerability, not a firmware issue. Affected tools include: H2OFFT version 3.02~5.28, 100.00.00.00~100.00.08.23 and 200.00.00.01~200.00.00.05, H2OOAE before version 200.00.00.02, H2OSDE before version 200.00.00.07, H2OUVE before version 200.00.02.02, H2OPCM before version 100.00.06.00, H2OELV before version 100.00.02.08."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://eclypsium.com/2019/08/10/screwed-drivers-signed-sealed-delivered/",
"refsource": "MISC",
"url": "https://eclypsium.com/2019/08/10/screwed-drivers-signed-sealed-delivered/"
},
{
"name": "https://www.insyde.com/security-pledge/SA-2019001",
"refsource": "CONFIRM",
"url": "https://www.insyde.com/security-pledge/SA-2019001"
},
{
"name": "https://security.netapp.com/advisory/ntap-20220223-0004/",
"refsource": "CONFIRM",
"url": "https://security.netapp.com/advisory/ntap-20220223-0004/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-12532",
"datePublished": "2019-08-26T17:06:07.000Z",
"dateReserved": "2019-06-02T00:00:00.000Z",
"dateUpdated": "2024-08-04T23:24:38.523Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2019-12532",
"date": "2026-09-28",
"epss": "0.00403",
"percentile": "0.31918"
},
"nvd": {
"cve": {
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:insyde:h2oelv:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A64F3B59-F104-4DEE-A196-DCBD76F790CC",
"versionEndExcluding": "100.00.02.08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:insyde:h2offt:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6BF51709-D72C-4E4E-B92D-B78553BDCE97",
"versionEndIncluding": "5.28",
"versionStartIncluding": "3.02",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:insyde:h2offt:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4A4D96B2-1C62-4F7D-95A5-9587808AE832",
"versionEndIncluding": "100.00.08.23",
"versionStartIncluding": "100.00.00.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:insyde:h2offt:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6894832B-0015-46A3-8BB5-46D35FE9F9D5",
"versionEndIncluding": "200.00.00.05",
"versionStartIncluding": "200.00.00.01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:insyde:h2ooae:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5410FBD1-F831-4740-991D-2A38C989FF8B",
"versionEndExcluding": "200.00.00.02",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:insyde:h2opcm:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2B7CD64C-5D98-4457-A834-BC1DDC4C94BA",
"versionEndExcluding": "100.00.06.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:insyde:h2osde:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B75D2834-4B85-4473-9B66-36A608C00C52",
"versionEndExcluding": "200.00.00.07",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:insyde:h2ouve:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3C1B7A5E-F3AA-4AD3-AE9B-92D12C542753",
"versionEndExcluding": "200.00.02.02",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Improper access control in the Insyde software tools may allow an authenticated user to potentially enable escalation of privilege, or information disclosure via local access. This is a software vulnerability, not a firmware issue. Affected tools include: H2OFFT version 3.02~5.28, 100.00.00.00~100.00.08.23 and 200.00.00.01~200.00.00.05, H2OOAE before version 200.00.00.02, H2OSDE before version 200.00.00.07, H2OUVE before version 200.00.02.02, H2OPCM before version 100.00.06.00, H2OELV before version 100.00.02.08."
},
{
"lang": "es",
"value": "El control de acceso inadecuado en las herramientas de software de Insyde puede permitir que un usuario autenticado permita potencialmente la escalada de privilegios o la divulgaci\u00f3n de informaci\u00f3n a trav\u00e9s del acceso local. Esta es una vulnerabilidad de software, no un problema de firmware. Las herramientas afectadas incluyen: H2OFFT versi\u00f3n 3.02 ~ 5.28, 100.00.00.00 ~ 100.00.08.23 y 200.00.00.01 ~ 200.00.00.05, H2OOAE antes de la versi\u00f3n 200.00.00.02, H2OSDE antes de la versi\u00f3n 200.00.00.07, H2OUVE antes de la versi\u00f3n 200.00.02.02, H2OPCM antes de la versi\u00f3n 100.00.06.00, H2OELV antes de la versi\u00f3n 100.00.02.08."
}
],
"id": "CVE-2019-12532",
"lastModified": "2024-11-21T04:23:03.323",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-08-26T18:15:11.797",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://eclypsium.com/2019/08/10/screwed-drivers-signed-sealed-delivered/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20220223-0004/"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://www.insyde.com/security-pledge/SA-2019001"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://eclypsium.com/2019/08/10/screwed-drivers-signed-sealed-delivered/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20220223-0004/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.insyde.com/security-pledge/SA-2019001"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…