{"id":"CVE-2019-17099","state":"PUBLISHED","title":"Untrusted Search Path vulnerability in EPSecurityService.exe (VA-3500)","description":"An Untrusted Search Path vulnerability in EPSecurityService.exe as used in Bitdefender Endpoint Security Tools versions prior to 6.6.11.163 allows an attacker to load an arbitrary DLL file from the search path. This issue affects: Bitdefender EPSecurityService.exe versions prior to 6.6.11.163.","publishedAt":"2020-01-27T17:23:06.763Z","updatedAt":"2024-09-16T17:02:47.446Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L","source":"Bitdefender"},"assigner":"Bitdefender","products":["Bitdefender EPSecurityService.exe"],"affected":[{"vendor":"Bitdefender","product":"EPSecurityService.exe","versions":[{"version":"6.6.11.162 and prior","status":"affected"}]}],"references":["https://www.bitdefender.com/support/security-advisories/untrusted-search-path-vulnerability-epsecurityservice-exe-va-3500/"],"weaknesses":["CWE-426"],"ingestedAt":"2026-10-29T19:45:38.896Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/17xxx/CVE-2019-17099.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2019-17099","state":"PUBLISHED","datePublished":"2020-01-27T17:23:06.763Z","dateUpdated":"2024-09-16T17:02:47.446Z","assignerShortName":"Bitdefender","assignerOrgId":"b3d5ebe7-963e-41fb-98e1-2edaeabb8f82","dateReserved":"2019-10-02T00:00:00.000Z"},"containers":{"cna":{"title":"Untrusted Search Path vulnerability in EPSecurityService.exe (VA-3500)","descriptions":[{"lang":"en","value":"An Untrusted Search Path vulnerability in EPSecurityService.exe as used in Bitdefender Endpoint Security Tools versions prior to 6.6.11.163 allows an attacker to load an arbitrary DLL file from the search path. This issue affects: Bitdefender EPSecurityService.exe versions prior to 6.6.11.163."}],"affected":[{"vendor":"Bitdefender","product":"EPSecurityService.exe","versions":[{"version":"6.6.11.162 and prior","status":"affected"}]}],"references":[{"url":"https://www.bitdefender.com/support/security-advisories/untrusted-search-path-vulnerability-epsecurityservice-exe-va-3500/","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-426","description":"CWE-426 Untrusted Search Path","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Bitdefender","dateUpdated":"2020-01-27T17:23:06.000Z","orgId":"b3d5ebe7-963e-41fb-98e1-2edaeabb8f82"},"credits":[{"lang":"en","value":"Bugcrowd user khangkito"}],"datePublic":"2019-12-18T00:00:00.000Z","solutions":[{"lang":"en","value":"Automatic update to version 6.6.11.163 mitigates the issue."}],"source":{"advisory":"VA-3500","defect":["VA-3500"],"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.0.9"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve-requests@bitdefender.com","DATE_PUBLIC":"2019-12-18T10:00:00.000Z","ID":"CVE-2019-17099","STATE":"PUBLIC","TITLE":"Untrusted Search Path vulnerability in EPSecurityService.exe (VA-3500)"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"EPSecurityService.exe","version":{"version_data":[{"version_value":"6.6.11.162 and prior"}]}}]},"vendor_name":"Bitdefender"}]}},"credit":[{"lang":"eng","value":"Bugcrowd user khangkito"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An Untrusted Search Path vulnerability in EPSecurityService.exe as used in Bitdefender Endpoint Security Tools versions prior to 6.6.11.163 allows an attacker to load an arbitrary DLL file from the search path. This issue affects: Bitdefender EPSecurityService.exe versions prior to 6.6.11.163."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-426 Untrusted Search Path"}]}]},"references":{"reference_data":[{"name":"https://www.bitdefender.com/support/security-advisories/untrusted-search-path-vulnerability-epsecurityservice-exe-va-3500/","refsource":"CONFIRM","url":"https://www.bitdefender.com/support/security-advisories/untrusted-search-path-vulnerability-epsecurityservice-exe-va-3500/"}]},"solution":[{"lang":"en","value":"Automatic update to version 6.6.11.163 mitigates the issue."}],"source":{"advisory":"VA-3500","defect":["VA-3500"],"discovery":"UNKNOWN"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.bitdefender.com/support/security-advisories/untrusted-search-path-vulnerability-epsecurityservice-exe-va-3500/","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-05T01:33:17.015Z"}}]}}}