CVE-2019-18956 Deserialization in n/a
Unauthenticated attackers can execute arbitrary code by sending a malicious serialized payload in the proxia-error cookie to the web application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-18956?
CVE-2019-18956 is a critical unsafe deserialization vulnerability in n/a, published on 17 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Divisa Proxia Suite 9 < 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 < 10.0.32, and 10.1 < 10.1.5, SparkSpace 1.0 < 1.0.30, 1.1 < 1.1.2, and 1.2 < 1.2.4, and Proxia PHR 1.0 < 1.0.30 and 1.1 < 1.1.2 allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a seria1.0lized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a serialized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. Affected products include Proxia Premium Edition 2017 and Sparkspace.
Weakness: CWE-502
Which versions are affected by CVE-2019-18956?
It affects 4 products.
Products include Divisait Dv2eemvc, Divisait Proxia Phr, Divisait Proxia Suite, Divisait Sparkspace.
How do I fix CVE-2019-18956?
No fix has been published for CVE-2019-18956 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2019-18956 being exploited?
There is no known exploitation of CVE-2019-18956 in the wild and no public exploit code.
Sources
Also known as GHSA-w2c8-98g2-v4mh.