CVE-2019-11654 A path traversal vulnerability has been identified in Verastream Host Integrator

High 8.6 Published 23 Aug 2019 Updated 4 Aug 2024

Remote unauthenticated attackers can read arbitrary files via path traversal in Micro Focus Verastream Host Integrator.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-11654?

CVE-2019-11654 is a high-severity path traversal vulnerability in Micro Focus Verastream Host Integrator, published on 23 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Path traversal vulnerability in Micro Focus Verastream Host Integrator (VHI), versions 7.7 SP2 and earlier, The vulnerability allows remote unauthenticated attackers to read arbitrary files.

Weakness: CWE-22

Which versions are affected by CVE-2019-11654?

It affects 1 product.

Products include Microfocus Verastream Host Integrator.

How do I fix CVE-2019-11654?

No fix has been published for CVE-2019-11654 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2019-11654 being exploited?

There is no known exploitation of CVE-2019-11654 in the wild and no public exploit code.

Sources

Also known as GHSA-rvwr-5mx9-7qqq.