CVEvulnerability
CVE-2018-19234
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-12-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
- Weaknesses
- CWE-494
Description
The Miss Marple Updater Service in COMPAREX Miss Marple Enterprise Edition before 2.0 allows remote attackers to execute arbitrary code with SYSTEM privileges via vectors related to missing update validation.
Affected configurations
• comparex miss marple (< 2.0)
Related
Weakness · CWE (1)
- CWE-494 Download of Code Without Integrity Check weakness
References
- http://packetstormsecurity.com/files/150427/Miss-Marple-Enterprise-Edition-File-Upload-Hardcoded-AES-Key.html Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2018/Nov/55 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2018/Nov/37 Mailing List, Third Party Advisory
- https://www.sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-miss-marple-enterprise-edition/ Third Party Advisory
- http://packetstormsecurity.com/files/150427/Miss-Marple-Enterprise-Edition-File-Upload-Hardcoded-AES-Key.html Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2018/Nov/55 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2018/Nov/37 Mailing List, Third Party Advisory
- https://www.sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilities-in-miss-marple-enterprise-edition/ Third Party Advisory