CVE-2019-11552
High
Description
Code42 Enterprise and Crashplan for Small Business Client version 6.7 before 6.7.5, 6.8 before 6.8.8, and 6.9 before 6.9.4 allows eval injection. A proxy auto-configuration file, crafted by a lesser privileged user, may be used to execute arbitrary code at a higher privilege as the service user.
SeverityHigh
CVSS7.0
Exploit probability—
ProductCode42 For Enterprise
PublishedJul 19, 2019
First seenJul 19, 2019
How to fix
Update
- code42 code42_for_enterprise6.7.5, 6.8.8, 6.9.4 or later
- code42 crashplan_for_small_business6.7.5, 6.8.8, 6.9.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| code42 code42_for_enterprise | 6.7 ≤ v < 6.7.5, 6.8 ≤ v < 6.8.8, 6.9 ≤ v < 6.9.4 | 6.7.5, 6.8.8, 6.9.4 |
| code42 crashplan_for_small_business | 6.7 ≤ v < 6.7.5, 6.8 ≤ v < 6.8.8, 6.9 ≤ v < 6.9.4 | 6.7.5, 6.8.8, 6.9.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.