Permissions, Privileges, and Access Controls in Script Security - CVE-2019-10355
Published: October 3, 2019 / Updated: October 7, 2019
Vulnerability identifier: #VU21528
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-10355
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to the sandbox protection can be circumvented by casting crafted objects to other types. A remote authenticated attacker who is able to specify sandboxed scripts can invoke constructors that were not whitelisted and execute arbitrary code on the target system.
Affected software
Script Security
How to mitigate CVE-2019-10355
Install updates from vendor's website.
Script Security - update to 1.62