CVEvulnerability
CVE-2019-19015
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-12-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-668
Description
An issue was discovered in TitanHQ WebTitan before 5.18. The proxy service (which is typically exposed to all users) allows connections to the internal PostgreSQL database of the appliance. By connecting to the database through the proxy (without password authentication), an attacker is able to fully control the appliance database. Through this, several different paths exist to gain further access, or execute code.
Affected configurations
• titanhq webtitan (< 5.18)
Related
Weakness · CWE (1)
- CWE-668 Exposure of Resource to Wrong Sphere weakness
References
- https://write-up.github.io/webtitan/ Exploit, Third Party Advisory
- https://www.webtitan.com/resources/product-updates/ Release Notes, Vendor Advisory
- https://write-up.github.io/webtitan/ Exploit, Third Party Advisory
- https://www.webtitan.com/resources/product-updates/ Release Notes, Vendor Advisory