CVE-2019-18642: sparkdevnetwork rock rms

csirt@kutim:~/threat-intel/cve/CVE-2019-18642

CVSS 9.8 · Critical EPSS 1,7%

Kerentanan pada sparkdevnetwork rock rms. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Rock RMS version before 8.6 is vulnerable to account takeover by tampering with the user ID parameter in the profile update feature. The lack of validation and use of sequential user IDs allows any user to change account details of any other user. This vulnerability could be used to change the email address of another account, even the administrator account. Upon changing another account's email address, performing a password reset to the new email address could allow an attacker to take over any account.

Rincian

Terbit di NVD: 7 Januari 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
EPSS (30 hari): 1,7% peluang dieksploitasi; lebih tinggi dari 76,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
sparkdevnetwork	rock rms	Semua versi sebelum 8.6

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://packetstormsecurity.com/files/160766/Rock-RMS-File-Upload-Account-Takeover-Information-Disclosure.html advisory pihak ketiga · vdb entry

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.