CVE-2018-12989

MEDIUM 6.7CVE-2018-12989 · Published 03/08/2018 · updated 17/06/2026

In short

CVE-2018-12989 is a MEDIUM (CVSS 6.7) vulnerability affecting console 8 (pearsonvue), iqsystem 7 (pearsonvue).
Chance of exploitation in the next 30 days (EPSS): 0.31%, higher than 24.5% of all vulnerabilities.
Fix: update to 2018-06-26 or later.

Package	Affected versions	Patched versions
console 8 pearsonvue	`< 2018-06-26`	`2018-06-26`
iqsystem 7 pearsonvue	`< 2018-06-26`	`2018-06-26`

Description

The report-viewing feature in Pearson VUE Certiport Console 8 and IQSystem 7 before 2018-06-26 mishandles child processes and consequently launches Internet Explorer or Microsoft Edge as Administrator, which allows local users to gain privileges.

References

certiport.pearsonvue.com/Support/Console-system-updates · Vendor Advisory
computeco.de/2018-07-29_1.html · Mitigation

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free