CVE-2019-5916

high-risk

Published 2019-02-13

Input validation issue in POWER EGG(Ver 2.0.1, Ver 2.02 Patch 3 and earlier, Ver 2.1 Patch 4 and earlier, Ver 2.2 Patch 7 and earlier, Ver 2.3 Patch 9 and earlier, Ver 2.4 Patch 13 and earlier, Ver 2.5 Patch 12 and earlier, Ver 2.6 Patch 8 and earlier, Ver 2.7 Patch 6 and earlier, Ver 2.7 Government Edition Patch 7 and earlier, Ver 2.8 Patch 6 and earlier, Ver 2.8c Patch 5 and earlier, Ver 2.9 Patch 4 and earlier) allows remote attackers to execute EL expression on the server via unspecified vectors.

Do I need to act?

0.87% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (13)

Power Egg

Affected Vendors

D-Circle

References (4)

Third Party Advisory http://jvn.jp/en/jp/JVN63860183/index.html

Vendor Advisory https://poweregg.d-circle.com/support/package/important/20190204_000780/

Third Party Advisory http://jvn.jp/en/jp/JVN63860183/index.html

Vendor Advisory https://poweregg.d-circle.com/support/package/important/20190204_000780/

/ 100

high-risk

Severity 32/34 · Critical

Exploitability 3/34 · Minimal

Exposure 17/34 · Moderate