CVE-2019-16287 Privilege escalation in ThinPro Linux
An attacker can bypass application filters to create a file that enables Administrative Mode, allowing execution of commands with elevated privileges on HP ThinPro Linux devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-16287?
CVE-2019-16287 is a medium-severity vulnerability in HP ThinPro Linux, published on 22 Nov 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In HP ThinPro Linux 6.2, 6.2.1, 7.0 and 7.1, an attacker may be able to leverage the application filter bypass vulnerability to gain privileged access to create a file on the local file system whose presence puts the device in Administrative Mode, which will allow the attacker to executed commands with elevated privileges.
Which versions are affected by CVE-2019-16287?
It affects 1 product.
Products include Hp Thinpro.
How do I fix CVE-2019-16287?
No fix has been published for CVE-2019-16287 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-16287 being exploited?
There is no known exploitation of CVE-2019-16287 in the wild and no public exploit code.
Other vulnerabilities in HP ThinPro Linux
Sources
Also known as GHSA-grqp-7p64-hvcr.