CVEvulnerability
CVE-2019-18910
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-11-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.8 MEDIUM — CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 4.6 MEDIUM — AV:L/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-78
Description
The Citrix Receiver wrapper function does not safely handle user supplied input, which may be leveraged by an attacker to inject commands that will execute with local user privileges.
Affected configurations
• hp thinpro 6.2
• hp thinpro 6.2.1
• hp thinpro 7.0
• hp thinpro 7.1
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- http://packetstormsecurity.com/files/156909/HP-ThinPro-6.x-7.x-Privileged-Command-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2020/Mar/40 Mailing List, Third Party Advisory
- https://support.hp.com/us-en/document/c06509350 Vendor Advisory
- http://packetstormsecurity.com/files/156909/HP-ThinPro-6.x-7.x-Privileged-Command-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2020/Mar/40 Mailing List, Third Party Advisory
- https://support.hp.com/us-en/document/c06509350 Vendor Advisory