← Back

CVE-2019-8459

nvd nist
Published: Jun 20, 2019Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without using quotes in the path. This can cause loading of a previously placed executable with a name similar to the parts of the path, instead of the intended one.

Affected (7)

Checkpoint
6 products
Jumbo Hotfix For Endpoint Security Server
Endpoint Security Server Package
Smartconsole For Endpoint Security Server
Endpoint Security Clients
Remote Access Clients
Capsule Docs Standalone Client
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Jumbo Hotfix For Endpoint Security Server
Before r77.30
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Endpoint Security Server Package
Before r77.30.03
Configuration C
2 vulnerable
Vulnerable SoftwareAffected Versions
Checkpoint
Smartconsole For Endpoint Security Server
Before r77.30.03
Smartconsole For Endpoint Security Server
Version e80.83
Configuration D
1 vulnerable
Vulnerable SoftwareAffected Versions
Endpoint Security Clients
Before e80.83
Configuration E
1 vulnerable
Vulnerable SoftwareAffected Versions
Remote Access Clients
Before e80.83
Configuration F
1 vulnerable
Vulnerable SoftwareAffected Versions
Capsule Docs Standalone Client
Before e80.82

Related CWEs

CWE-428
Unquoted Search Path or Element
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.

References (2)

Source: cve@checkpoint.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.