Back to Database
Status published
High
CVE-2019-11552
Code42 Enterprise and Crashplan for Small Business Client version 6.7...
Vulnerability Description
Code42 Enterprise and Crashplan for Small Business Client version 6.7 before 6.7.5, 6.8 before 6.8.8, and 6.9 before 6.9.4 allows eval injection. A proxy auto-configuration file, crafted by a lesser privileged user, may be used to execute arbitrary code at a higher privilege as the service user.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-11552
Credits & Attribution
No credits recorded in the NVD database.
References
More from code42
View All →CVE-2021-43269
In Code42 app before 8.8.0, eval injection allows an attacker...
High
8.8
CVE-2020-12736
Code42 environments with on-premises server versions 7.0.4 and earlier allow...
High
7.2
CVE-2019-16861
Code42 server through 7.0.2 for Windows has an Untrusted Search...
High
7.3
CVE-2019-16860
Code42 app through version 7.0.2 for Windows has an Untrusted...
High
7.3
CVE-2019-15131
In Code42 Enterprise 6.7.5 and earlier, 6.8.4 through 6.8.8, and...
Critical
9.8
Affected Vendor
code42
View all reports →Affected Software
code42 for enterprise, crashplan for small business
Vulnerable Versions:
6.7, 6.8, 6.9
Timeline
Official Publish:
July 19th, 2019
Last Modified:
August 4th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.