CVE-2019-12162

Published: Jul 23, 2019Modified: Jun 17, 2026

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which could lead to code execution or local privilege escalation by replacing the original update.exe.

Affected (1)

Products: Upwork: Time Tracker

Upwork

1 product

Time Tracker

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Upwork Time Tracker	Version 5.2.2.716

Related CWEs

CWE-494

Download of Code Without Integrity Check

The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

References (4)

https://support.upwork.com/hc/en-us/categories/360001180954

Source: cve@mitre.org

ProductVendor Advisory

https://vuldb.com/?id.138406

Source: cve@mitre.org

Third Party Advisory

https://support.upwork.com/hc/en-us/categories/360001180954

Source: af854a3a-2127-422b-91ae-364da2661108

ProductVendor Advisory

https://vuldb.com/?id.138406

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.