CVE-2019-12162 Supply chain in n/a
Attackers can execute arbitrary code or escalate privileges by replacing the update executable due to missing hash verification in Upwork Time Tracker.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-12162?
CVE-2019-12162 is a high-severity vulnerability in n/a, published on 23 Jul 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code execution or local privilege escalation by replacing the original update.exe.
Weakness: CWE-494
Which versions are affected by CVE-2019-12162?
It affects 1 product.
Products include Upwork Time Tracker.
How do I fix CVE-2019-12162?
No fix has been published for CVE-2019-12162 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-12162 being exploited?
There is no known exploitation of CVE-2019-12162 in the wild and no public exploit code.
Sources
Also known as GHSA-qrh2-pgj6-rv2j.