CVE-2019-12091

Netskope client command injections vulnerability

State: Published
Severity: 7.8 High
Published: Sep 26, 2019
Updated: Aug 4, 2024
Reserved: May 14, 2019

Description

The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\SYSTEM privilege, accepts network connections from localhost. The connection handling function in this service suffers from command injection vulnerability. Local users can use this vulnerability to execute code with NT\SYSTEM privilege.

Scores

CVSS	Score	Vector	Source
3.0	7.8 High	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	airbus

Weaknesses

CWE-78 Command injection

Affected Products

Product	Versions
Netskope clientNetskope	Netskope client 60.2.0.214Not affected Netskope client 57.2.0.219Not affected 57 to before Netskope client*Affectedfrom 62Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.