CVE-2019-11660
HIGHMicro Focus Data Protector <10.50 - Privilege Escalation
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2019-11660.
PoCs published by Metasploit, s7u55, including Metasploit module exploits/linux/local/omniresolve_suid_priv_esc.
AI-analyzed exploit summary This Metasploit module exploits a SUID binary (`omniresolve`) in Micro Focus (HPE) Data Protector by manipulating the `$PATH` environment variable to execute a malicious `oracleasm` binary with root privileges.
Description
Privileges manipulation in Micro Focus Data Protector, versions 10.00, 10.01, 10.02, 10.03, 10.04, 10.10, 10.20, 10.30, 10.40. This vulnerability could be exploited by a low-privileged user to execute a custom binary with higher privileges.
Exploits (2)
This Metasploit module exploits a SUID binary (`omniresolve`) in Micro Focus (HPE) Data Protector by manipulating the `$PATH` environment variable to execute a malicious `oracleasm` binary with root privileges.
This Metasploit module exploits a SUID binary (`omniresolve`) in Micro Focus (HPE) Data Protector by manipulating the `$PATH` environment variable to execute a malicious `oracleasm` binary with root privileges. It leverages a relative path vulnerability to achieve local privilege escalation.
References (2)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H