Details of VAR-202002-0475

ID

VAR-202002-0475

CVE

CVE-2019-19669

TITLE

Rumpus FTP Web File Manager Upload Center Forms Component Cross-Site Request Forgery Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2020-04697 // CNNVD: CNNVD-202002-343

DESCRIPTION

A CSRF vulnerability exists in the Upload Center Forms Component of Web File Manager in Rumpus FTP 8.2.9.1. This could allow an attacker to delete, create, and update the upload forms via RAPR/TriggerServerFunction.html. Rumpus FTP Exists in a cross-site request forgery vulnerability.Information may be tampered with. The vulnerability stems from a web application's insufficient verification that the request came from a trusted user. An attacker could use this vulnerability to send an unexpected request to the server through an affected client

Trust: 2.16

sources: NVD: CVE-2019-19669 // JVNDB: JVNDB-2019-014500 // CNVD: CNVD-2020-04697

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-04697

AFFECTED PRODUCTS

vendor:	maxum	model:	rumpus ftp	scope:	eq	version:	8.2.9.1	Trust: 1.0
vendor:	maxum	model:	rumpus	scope:	eq	version:	ftp 8.2.9.1	Trust: 0.8
vendor:	maxum	model:	rumpus ftp server	scope:	eq	version:	8.2.9.1	Trust: 0.6

sources: CNVD: CNVD-2020-04697 // JVNDB: JVNDB-2019-014500 // NVD: CVE-2019-19669

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-19669
value:	MEDIUM
Trust: 1.0
NVD:	JVNDB-2019-014500
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2020-04697
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202002-343
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2019-19669
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	JVNDB-2019-014500
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2020-04697
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:C/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	COMPLETE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2019-19669
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	JVNDB-2019-014500
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-04697 // JVNDB: JVNDB-2019-014500 // CNNVD: CNNVD-202002-343 // NVD: CVE-2019-19669

PROBLEMTYPE DATA

problemtype:

CWE-352

Trust: 1.8

sources: JVNDB: JVNDB-2019-014500 // NVD: CVE-2019-19669

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202002-343

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-202002-343

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-014500

PATCH

title:

Rumpus

url:

https://www.maxum.com/Rumpus/

Trust: 0.8

sources: JVNDB: JVNDB-2019-014500

EXTERNAL IDS

db:	NVD	id:	CVE-2019-19669	Trust: 3.0
db:	JVNDB	id:	JVNDB-2019-014500	Trust: 0.8
db:	CNVD	id:	CNVD-2020-04697	Trust: 0.6
db:	CNNVD	id:	CNNVD-202002-343	Trust: 0.6

sources: CNVD: CNVD-2020-04697 // JVNDB: JVNDB-2019-014500 // CNNVD: CNNVD-202002-343 // NVD: CVE-2019-19669

REFERENCES

url:	https://github.com/harshit-shukla/cve/blob/master/cve-2019-19669.md	Trust: 3.0
url:	https://nvd.nist.gov/vuln/detail/cve-2019-19669	Trust: 2.0
url:	https://github.com/harshit-shukla/cve	Trust: 1.6
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-19669	Trust: 0.8

sources: CNVD: CNVD-2020-04697 // JVNDB: JVNDB-2019-014500 // CNNVD: CNNVD-202002-343 // NVD: CVE-2019-19669

SOURCES

db:	CNVD	id:	CNVD-2020-04697
db:	JVNDB	id:	JVNDB-2019-014500
db:	CNNVD	id:	CNNVD-202002-343
db:	NVD	id:	CVE-2019-19669

LAST UPDATE DATE

2024-11-23T22:11:38.328000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-04697	date:	2020-02-12T00:00:00
db:	JVNDB	id:	JVNDB-2019-014500	date:	2020-02-21T00:00:00
db:	CNNVD	id:	CNNVD-202002-343	date:	2021-01-05T00:00:00
db:	NVD	id:	CVE-2019-19669	date:	2024-11-21T04:35:09.657

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-04697	date:	2020-02-12T00:00:00
db:	JVNDB	id:	JVNDB-2019-014500	date:	2020-02-21T00:00:00
db:	CNNVD	id:	CNNVD-202002-343	date:	2020-02-10T00:00:00
db:	NVD	id:	CVE-2019-19669	date:	2020-02-10T18:15:12.080