CVE-2019-18956

緊急 9.8CVE-2019-18956 · 17/12/2019 公開 · 17/06/2026 更新

要点

CVE-2019-18956 は dv2eemvc (divisait), proxia phr (divisait), proxia suite (divisait) に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：5.8%（全脆弱性の 93.1% より高い）。
対処：18.6.42, 19.0.13, 19.1.19, 19.2.41 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
dv2eemvc divisait	`≥ 17-62, ≤ 17-147≥ 18.6, < 18.6.42≥ 19.0, < 19.0.13≥ 19.1, < 19.1.19≥ 19.2, < 19.2.41≥ 19.3, < 19.3.37≥ 19.4, < 19.4.13≥ 20.0, < 20.0.13`	`18.6.4219.0.1319.1.1919.2.4119.3.3719.4.1320.0.13`
proxia phr divisait	`≥ 1.0, < 1.0.30≥ 1.1, < 1.1.2`	`1.0.301.1.2`
proxia suite divisait	`≥ 10.0, < 10.0.32≥ 10.1, < 10.1.5≥ 9.0, < 9.12.16`	`10.0.3210.1.59.12.16`
sparkspace divisait	`≥ 1.0, < 1.0.30≥ 1.1, < 1.1.2≥ 1.2, < 1.2.4`	`1.0.301.1.21.2.4`

概要

Divisa Proxia Suite 9 < 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 < 10.0.32, and 10.1 < 10.1.5, SparkSpace 1.0 < 1.0.30, 1.1 < 1.1.2, and 1.2 < 1.2.4, and Proxia PHR 1.0 < 1.0.30 and 1.1 < 1.1.2 allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a seria1.0lized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a serialized payload in order to execute arbitrary code via the prepareError function in the com.divisait.dv2ee.controller.MVCControllerServlet class of the dv2eemvc.jar component. Affected products include Proxia Premium Edition 2017 and Sparkspace.