CVE-2019-12569
published 2019-06-03CVE-2019-12569: A vulnerability in Viber before 10.7.0 for Desktop (Windows) could allow an attacker to execute arbitrary commands on a targeted system. This vulnerability is…
PriorityP348high7.8CVSS 3.0
AVLACLPRNUIRSUCHIHAH
EPSS
15.04%
96.3th percentile
A vulnerability in Viber before 10.7.0 for Desktop (Windows) could allow an attacker to execute arbitrary commands on a targeted system. This vulnerability is due to unsafe search paths used by the application URI. An attacker could exploit this vulnerability by convincing a targeted user to follow a malicious link. Successful exploitation could cause the application to load libraries from the directory targeted by the URI link. The attacker could use this behavior to execute arbitrary commands on the system with the privileges of the targeted user, if the attacker can place a crafted library in a directory that is accessible to the vulnerable system.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rakuten | viber | < 10.7.0 | 10.7.0 |
| rakuten | viber | < 13.2.0.39 | 13.2.0.39 |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-r3v6-qx45-r3j8: Viber for Windows up to 13
ghsa_unreviewed·2022-05-24·CVSS 7.8
CVE-2020-14049 [HIGH] CWE-428 GHSA-r3v6-qx45-r3j8: Viber for Windows up to 13
Viber for Windows up to 13.2.0.39 does not properly quote its custom URI handler. A malicious website could launch Viber with arbitrary parameters, forcing a victim to send an NTLM authentication request, and either relay the request or capture the hash for offline password cracking. NOTE: this issue exists because of an incomplete fix for CVE-2019-12569.
GHSA
GHSA-gp9r-j3mw-3g9f: A vulnerability in Viber before 10
ghsa_unreviewed·2022-05-24
CVE-2019-12569 [HIGH] GHSA-gp9r-j3mw-3g9f: A vulnerability in Viber before 10
A vulnerability in Viber before 10.7.0 for Desktop (Windows) could allow an attacker to execute arbitrary commands on a targeted system. This vulnerability is due to unsafe search paths used by the application URI. An attacker could exploit this vulnerability by convincing a targeted user to follow a malicious link. Successful exploitation could cause the application to load libraries from the directory targeted by the URI link. The attacker could use this behavior to execute arbitrary commands on the system with the privileges of the targeted user, if the attacker can place a crafted library in a directory that is accessible to the vulnerable system.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-06-03
Published