CVE-2019-18956
Description
Divisa Proxia Suite 9 < 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 < 10.0.32, and 10.1 < 10.1.5, SparkSpace 1.0 < 1.0.30, 1.1 < 1.1.2, and 1.2 < 1.2.4, and Proxia PHR 1.0 < 1.0.30 and 1.1 < 1.1.2 allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a seria1.0lized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a serialized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. Affected products include Proxia Premium Edition 2017 and Sparkspace.
How to fix
- divisait dv2eemvc18.6.42, 19.0.13, 19.1.19, 19.2.41, 19.3.37, 19.4.13, 20.0.13 or later
- divisait proxia_phr1.0.30, 1.1.2 or later
- divisait proxia_suite9.12.16, 10.0.32, 10.1.5 or later
- divisait sparkspace1.0.30, 1.1.2, 1.2.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| divisait dv2eemvc | 17-62 ≤ v ≤ 17-147, 18.6 ≤ v < 18.6.42, 19.0 ≤ v < 19.0.13, 19.1 ≤ v < 19.1.19, 19.2 ≤ v < 19.2.41, 19.3 ≤ v < 19.3.37, 19.4 ≤ v < 19.4.13, 20.0 ≤ v < 20.0.13 | 18.6.42, 19.0.13, 19.1.19, 19.2.41, 19.3.37, 19.4.13, 20.0.13 |
| divisait proxia_phr | 1.0 ≤ v < 1.0.30, 1.1 ≤ v < 1.1.2 | 1.0.30, 1.1.2 |
| divisait proxia_suite | 9.0 ≤ v < 9.12.16, 10.0 ≤ v < 10.0.32, 10.1 ≤ v < 10.1.5 | 9.12.16, 10.0.32, 10.1.5 |
| divisait sparkspace | 1.0 ≤ v < 1.0.30, 1.1 ≤ v < 1.1.2, 1.2 ≤ v < 1.2.4 | 1.0.30, 1.1.2, 1.2.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.