Improper input validation in Johnson Controls Kantech Entrapass Corporate Edition
CVE-2019-7589
A vulnerability with the SmartService API Service option exists whereby an unauthorized user could potentially exploit this to upload malicious code to the server that could be executed at system level privileges. This affects Johnson Controls' Kantech EntraPass Corporate Edition versions 8.0 and prior; Kantech EntraPass Global Edition versions 8.0 and prior.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.016 (73.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Johnson Controls Kantech Entrapass Corporate Edition — versions versions 8.0 and prior
- Johnson Controls Kantech Entrapass Global Edition — versions versions 8.0 and prior
- Johnsoncontrols Entrapass
Weakness classification (CWE)
References
- productsecurity@jci.com (x_refsource_CONFIRM, Vendor Advisory)
- productsecurity@jci.com (US Government Resource, Third Party Advisory, x_refsource_CERT, third-party-advisory)
Frequently asked questions
- What is CVE-2019-7589?
- CVE-2019-7589 is a critical-severity vulnerability in Johnson Controls Kantech Entrapass Corporate Edition, classified under Improper Input Validation. CVSS score: 9.8/10. Published 2020-03-10.
- How severe is CVE-2019-7589?
- Critical severity. CVSS v3 base score is 9.8 out of 10.