CVE-2019-8385

CRITIQUE 9.8CVE-2019-8385 · Published 05/06/2019 · updated 17/06/2026

En bref

CVE-2019-8385 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant concourse matter room (thomsonreuters), firm central desktop (thomsonreuters).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 19.6%, plus élevée que 97.4% des vulnérabilités.
Correctif : mettre à jour vers 2.13.0098 ou plus récent.

Package	Affected versions	Patched versions
concourse matter room thomsonreuters	`< 2.13.0098`	`2.13.0098`
firm central desktop thomsonreuters	`< 2.13.0098`	`2.13.0098`

Description

An issue was discovered in Thomson Reuters Desktop Extensions 1.9.0.358. An unauthenticated directory traversal and local file inclusion vulnerability in the ThomsonReuters.Desktop.Service.exe and ThomsonReuters.Desktop.exe allows a remote attacker to list or enumerate sensitive contents of files via a \.. to port 6677. Additionally, this could allow for privilege escalation by dumping the affected machine's SAM and SYSTEM database files, as well as remote code execution.

References

packetstormsecurity.com/files/152298/Thomson-Reuters-Concourse-And-Firm-Central-Local-File-Inclusion-Directory-Traversal.html · Exploit
thomsonreuters.com/en/products-services.html · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free