Websense Forcepoint User ID up to 1.2 Service Port 5001 unrestricted upload

Summaryinfo

A vulnerability categorized as critical has been discovered in Websense Forcepoint User ID up to 1.2. The affected element is an unknown function of the component Service Port 5001. Executing a manipulation can lead to unrestricted upload. This vulnerability is tracked as CVE-2019-6139. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Websense Forcepoint User ID up to 1.2. It has been declared as critical. This vulnerability affects an unknown functionality of the component Service Port 5001. The manipulation with an unknown input leads to a unrestricted upload vulnerability. The CWE definition for the vulnerability is CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Forcepoint User ID (FUID) server versions up to 1.2 have a remote arbitrary file upload vulnerability on TCP port 5001. Successful exploitation of this vulnerability may lead to remote code execution. To fix this vulnerability, upgrade to FUID version 1.3 or higher. To prevent the vulnerability on FUID versions 1.2 and below, apply local firewall rules on the FUID server to disable all external access to port TCP/5001. FUID requires this port only for local connections through the loopback interface.

The bug was discovered 01/24/2019. The weakness was disclosed 02/07/2019. This vulnerability was named CVE-2019-6139 since 01/11/2019. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1608.002 by the MITRE ATT&CK project.

The vulnerability was handled as a non-public zero-day exploit for at least 14 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Websense

Name

• Forcepoint User ID

Version

• 1.0
• 1.1
• 1.2

License

• commercial

Website

• Vendor: https://www.forcepoint.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion