CVE-2019-19364: sony catalyst_browse Uncontrolled Search Path Element

Vulnerability summary

CVE-2019-19364 is a high (CVSS 7.8) Uncontrolled Search Path Element vulnerability in sony catalyst_browse. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 04-12-2019
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

A weak malicious user can escalate its privilege whenever CatalystProductionSuite.2019.1.exe (version 1.1.0.21) and CatalystBrowseSuite.2019.1.exe (version 1.1.0.21) installers run. The vulnerability is in the form of DLL Hijacking. The installers try to load DLLs that don’t exist from its current directory; by doing so, an attacker can quickly escalate its privileges.

• CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.