Vulnerability-Lookup

CNVD-2020-01948

Vulnerability from cnvd - Published: 2020-01-14

Title

多款Kaspersky产品输入验证错误漏洞（CNVD-2020-01948）

Description

Kaspersky Anti-Virus等都是俄罗斯卡巴斯基（Kaspersky）实验室的产品。Kaspersky Anti-Virus是一套杀毒软件。Kaspersky Internet Security是一套同时具有反病毒和防火墙功能的安全软件。Kaspersky Total Security是一套全功能安全软件。多款Kaspersky产品中的Web保护组件存在输入验证错误漏洞。目前没有详细漏洞细节提供。

Severity

中

Patch Name

多款Kaspersky产品输入验证错误漏洞（CNVD-2020-01948）的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1

Reference

https://nvd.nist.gov/vuln/detail/CVE-2019-15688

Impacted products

Name
['Kaspersky Internet Security', 'Kaspersky Anti-Virus', 'Kaspersky Small Office Security', 'Kaspersky Total Security', 'Kaspersky Free Anti-Virus', 'Kaspersky Security Cloud']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-15688"
    }
  },
  "description": "Kaspersky Anti-Virus\u7b49\u90fd\u662f\u4fc4\u7f57\u65af\u5361\u5df4\u65af\u57fa\uff08Kaspersky\uff09\u5b9e\u9a8c\u5ba4\u7684\u4ea7\u54c1\u3002Kaspersky Anti-Virus\u662f\u4e00\u5957\u6740\u6bd2\u8f6f\u4ef6\u3002Kaspersky Internet Security\u662f\u4e00\u5957\u540c\u65f6\u5177\u6709\u53cd\u75c5\u6bd2\u548c\u9632\u706b\u5899\u529f\u80fd\u7684\u5b89\u5168\u8f6f\u4ef6\u3002Kaspersky Total Security\u662f\u4e00\u5957\u5168\u529f\u80fd\u5b89\u5168\u8f6f\u4ef6\u3002\n\n\u591a\u6b3eKaspersky\u4ea7\u54c1\u4e2d\u7684Web\u4fdd\u62a4\u7ec4\u4ef6\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-01948",
  "openTime": "2020-01-14",
  "patchDescription": "Kaspersky Anti-Virus\u7b49\u90fd\u662f\u4fc4\u7f57\u65af\u5361\u5df4\u65af\u57fa\uff08Kaspersky\uff09\u5b9e\u9a8c\u5ba4\u7684\u4ea7\u54c1\u3002Kaspersky Anti-Virus\u662f\u4e00\u5957\u6740\u6bd2\u8f6f\u4ef6\u3002Kaspersky Internet Security\u662f\u4e00\u5957\u540c\u65f6\u5177\u6709\u53cd\u75c5\u6bd2\u548c\u9632\u706b\u5899\u529f\u80fd\u7684\u5b89\u5168\u8f6f\u4ef6\u3002Kaspersky Total Security\u662f\u4e00\u5957\u5168\u529f\u80fd\u5b89\u5168\u8f6f\u4ef6\u3002\r\n\r\n\u591a\u6b3eKaspersky\u4ea7\u54c1\u4e2d\u7684Web\u4fdd\u62a4\u7ec4\u4ef6\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eKaspersky\u4ea7\u54c1\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff08CNVD-2020-01948\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Kaspersky Internet Security",
      "Kaspersky Anti-Virus",
      "Kaspersky Small Office Security",
      "Kaspersky Total Security",
      "Kaspersky Free Anti-Virus",
      "Kaspersky Security Cloud"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2019-15688",
  "serverity": "\u4e2d",
  "submitTime": "2019-11-28",
  "title": "\u591a\u6b3eKaspersky\u4ea7\u54c1\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff08CNVD-2020-01948\uff09"
}

CVE-2019-15688 (GCVE-0-2019-15688)

Vulnerability from cvelistv5 – Published: 2019-11-26 15:32 – Updated: 2024-08-05 00:56

Summary

Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component did not adequately inform the user about the threat of redirecting to an untrusted site. Bypass.

Severity

No CVSS data available.

CWE

Bypass

Assigner

Kaspersky CNA under the mitre root

CNA scorecard C 75/100 over 10 records in the last 180 days details

References

1 reference

URL	Tags
https://support.kaspersky.com/general/vulnerabili…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
Kaspersky	Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud	Affected: up to 2020

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:56:22.438Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud",
          "vendor": "Kaspersky",
          "versions": [
            {
              "status": "affected",
              "version": "up to 2020"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component did not adequately inform the user about the threat of redirecting to an untrusted site. Bypass."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Bypass",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-26T15:32:17.000Z",
        "orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
        "shortName": "Kaspersky"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vulnerability@kaspersky.com",
          "ID": "CVE-2019-15688",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "up to 2020"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Kaspersky"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component did not adequately inform the user about the threat of redirecting to an untrusted site. Bypass."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Bypass"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1",
              "refsource": "CONFIRM",
              "url": "https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
    "assignerShortName": "Kaspersky",
    "cveId": "CVE-2019-15688",
    "datePublished": "2019-11-26T15:32:17.000Z",
    "dateReserved": "2019-08-27T00:00:00.000Z",
    "dateUpdated": "2024-08-05T00:56:22.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted