CVE-2019-6139 File upload in Forcepoint User ID (FUID) server
Remote attackers can upload arbitrary files to the Forcepoint User ID server, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-6139?
CVE-2019-6139 is a critical vulnerability in Forcepoint User ID (FUID) server, published on 7 Feb 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Forcepoint User ID (FUID) server versions up to 1.2 have a remote arbitrary file upload vulnerability on TCP port 5001. Successful exploitation of this vulnerability may lead to remote code execution. To fix this vulnerability, upgrade to FUID version 1.3 or higher. To prevent the vulnerability on FUID versions 1.2 and below, apply local firewall rules on the FUID server to disable all external access to port TCP/5001. FUID requires this port only for local connections through the loopback interface.
Weakness: CWE-434
Which versions are affected by CVE-2019-6139?
It affects 1 product.
Products include Forcepoint User Id.
How do I fix CVE-2019-6139?
No fix has been published for CVE-2019-6139 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-6139 being exploited?
There is no known exploitation of CVE-2019-6139 in the wild and no public exploit code.
Sources
Also known as GHSA-3pcr-r262-49qp.