CVE-2019-5443

Summary

CVE	CVE-2019-5443
State	PUBLISHED
Assigner	hackerone
Source Priority	CVE Program / NVD first with legacy fallback
Published	2019-07-02 19:15:10 UTC
Updated	2026-10-14 07:16:54 UTC
Description	A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.

Primary CVSS: v3.1 7.8 HIGH from [email protected]

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Problem Types: CWE-94 | CWE-427 | CWE-94 Code Injection (CWE-94)

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	7.8	HIGH	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
2.0	[email protected]	Primary	4.4		`AV:L/AC:M/Au:N/C:P/I:P/A:P`

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Access Vector

Local

Access Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

AV:L/AC:M/Au:N/C:P/I:P/A:P

Type	Vendor	Product	Version	Update	Edition	Language
Application	Haxx	Curl	All	All	All	All
Operating System	Microsoft	Windows	-	All	All	All
Application	Netapp	Oncommand Insight	-	All	All	All
Application	Netapp	Oncommand Unified Manager	All	All	All	All
Application	Netapp	Oncommand Unified Manager	All	All	All	All
Application	Netapp	Oncommand Workflow Automation	-	All	All	All
Application	Netapp	Snapcenter	-	All	All	All
Application	Oracle	Enterprise Manager Ops Center	12.3.3	All	All	All
Application	Oracle	Enterprise Manager Ops Center	12.4.0	All	All	All
Application	Oracle	Http Server	12.2.1.3.0	All	All	All
Application	Oracle	Http Server	12.2.1.4.0	All	All	All
Application	Oracle	Mysql Server	All	All	All	All
Application	Oracle	Mysql Server	All	All	All	All
Application	Oracle	Oss Support Tools	20.0	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Na	Curl	affected <= 7.65.1	Not specified
ADP	Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified
ADP	Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified
ADP	Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified
ADP	Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified
ADP	Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified

Reference	Source	Link	Tags
cert-portal.siemens.com/productcert/html/ssa-398330.html	0b142b55-0307-4c5a-b3c9-f314f3fb7c5e	cert-portal.siemens.com
curl - Windows OpenSSL engine code injection - CVE-2019-5443	af854a3a-2127-422b-91ae-364da2661108	curl.haxx.se	Patch, Vendor Advisory
Oracle Critical Patch Update - October 2019	af854a3a-2127-422b-91ae-364da2661108	www.oracle.com	Patch, Third Party Advisory
Oracle Critical Patch Update Advisory - October 2020	af854a3a-2127-422b-91ae-364da2661108	www.oracle.com	Patch, Third Party Advisory
October 2019 MySQL Vulnerabilities in NetApp Products \| NetApp Product Security	af854a3a-2127-422b-91ae-364da2661108	security.netapp.com	Third Party Advisory
Oracle Critical Patch Update Advisory - April 2020	af854a3a-2127-422b-91ae-364da2661108	www.oracle.com	Patch, Third Party Advisory
curl CVE-2019-5443 Local Code Injection Vulnerability	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com	Broken Link
oss-security - curl: Windows OpenSSL engine code injection	af854a3a-2127-422b-91ae-364da2661108	www.openwall.com	Mailing List, Patch, Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

591406 Siemens SIMATIC S7-1500 CPU GNU/Linux subsystem Multiple Vulnerabilities (SSB-439005, ICSA-22-104-13)