External Control of Critical State Data in eSOMS - CVE-2019-19092
Published: March 13, 2020
Vulnerability identifier: #VU26066
CSH Severity: Low
CVSS v4: 2.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-19092
CWE-ID: CWE-642
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform some alternations in the target system.
The vulnerability exists due to the affected software uses ASP.NET Viewstate without Message Authentication Code (MAC). Alterations to Viewstate might thus not be noticed.
Affected software
eSOMS
How to mitigate CVE-2019-19092
Install updates from vendor's website.
eSOMS - update to 6.0.3