Improper Privilege Management in rConfig - CVE-2019-19585
Published: January 6, 2020 / Updated: June 17, 2021
Vulnerability identifier: #VU34903
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2019-19585
CWE-ID: CWE-269
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vendor: rConfig
Affected software:
rConfig
rConfig
Detailed vulnerability description
The vulnerability allows a local authenticated user to execute arbitrary code.
An issue was discovered in rConfig 3.9.3. The install script updates the /etc/sudoers file for rconfig specific tasks. After an "rConfig specific Apache configuration" update, apache has high privileges for some binaries. This can be exploited by an attacker to bypass local security restrictions.
How to mitigate CVE-2019-19585
Install update from vendor's website.