CVE-2019-12491

OnApp before 5.0.0-88, 5.5.0-93, and 6.0.0-196 allows an attacker to run arbitrary commands with root privileges on servers managed by OnApp for XEN/KVM hypervisors. To exploit the vulnerability an attacker has to have control of a single server on a given cloud (e.g. by renting one). From the source server, the attacker can craft any command and trigger the OnApp platform to execute that command with root privileges on a target server.

Link	Resource
https://skylightcyber.com/2019/06/07/all-your-cloud-are-belong-to-us-cve-2019-12491/	Third Party Advisory
https://docs.onapp.com/rn/general-security-advisory	Mitigation Patch

Configuration 1

cpe:2.3:a:onapp:onapp:6.0:update_62:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:6.0:update_80:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:6.0:update_98:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:6.0:update_122:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:6.0:update_152:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:6.0:update_159:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.0.0:-:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.0.0:update_79:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.0.0:update_82:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.0.0:update_83:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.0.0:update_87:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.1.0:-:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.1.0:update_16:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.2.0:-:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.3.0:-:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.3.0:update_41:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.4.0:-:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.4.0:update_66:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.4.0:update_70:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.4.0:update_72:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.4.0:update_76:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.4.0:update_82:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.4.0:update_84:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.5.0:-:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.5.0:update_50:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.5.0:update_59:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.5.0:update_65:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.5.0:update_75:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.5.0:update_80:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.5.0:update_83:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.5.0:update_87:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.5.0:update_90:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.5.0:update_92:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.6.0:-:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.6.0:update_83:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.7.0:-:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.8.0:-:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.9.0:-:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:5.10.0:-:*:*:*:*:*:* cpe:2.3:a:onapp:onapp:6.0.0:-:*:*:*:*:*:*

---

Published : 2019-06-19 04:15

Updated : 2020-08-24 05:37

---

NVD link : CVE-2019-12491

Mitre link : CVE-2019-12491

No products.

NVD-CWE-noinfo