CVE-2019-13028

Published: Jun 28, 2019Modified: Nov 21, 2024

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

An incorrect implementation of a local web server in eID client (Windows version before 3.1.2, Linux version before 3.0.3) allows remote attackers to execute arbitrary code (.cgi, .pl, or .php) or delete arbitrary files via a crafted HTML page. This is a product from the Ministry of Interior of the Slovak Republic.

Affected (2)

Products: Minv: Electronic Identification Cards Client

1 product

Electronic Identification Cards Client

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Minv Electronic Identification Cards Client	Before 3.0.3
Minv Electronic Identification Cards Client	Before 3.1.2

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (6)

https://www.csirt.gov.sk/aktualne-7d7.html?id=194

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.csirt.gov.sk/doc/eid_klient_tlacova_sprava.pdf

Source: cve@mitre.org

Third Party Advisory

https://www.minv.sk/?tlacove-spravy&sprava=pouzivatelom-e-sluzieb-automaticky-aktualizujeme-aplikaciu-pre-elektronicky-obciansky-preukaz

Source: cve@mitre.org

Third Party Advisory

https://www.csirt.gov.sk/aktualne-7d7.html?id=194

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.csirt.gov.sk/doc/eid_klient_tlacova_sprava.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.minv.sk/?tlacove-spravy&sprava=pouzivatelom-e-sluzieb-automaticky-aktualizujeme-aplikaciu-pre-elektronicky-obciansky-preukaz

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.