Skip to main content

Signal CVE-2019-19954

HIGH
Uncontrolled Search Path Element (CWE-427)
2019-12-24 cve@mitre.org
Information Disclosure Microsoft Signal Signal Desktop
7.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.3 HIGH
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Dec 24, 2019 - 15:15 nvd
HIGH 7.3

DescriptionNVD

Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\node_modules\.bin\wmic.exe file.

AnalysisAI

Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\node_modules\.bin\wmic.exe file. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-427. Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\node_modules\.bin\wmic.exe file. Affected products include: Signal Signal-Desktop. Version information: before 1.29.1.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Signal

View all
CVE-2023-24068 HIGH POC
7.8 Jan 23

Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to modify conversation attachments within th
CVE-2022-28345 HIGH POC
7.5 Apr 15

The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. Rated high severity (CVSS 7.5), this vulnerab
CVE-2019-17191 HIGH POC
7.5 Oct 05

The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, witho
CVE-2018-10994 MEDIUM POC
6.1 May 14

js/views/message_view.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL. Rated medium se
CVE-2019-17192 CRITICAL
9.8 Oct 05

The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing

CVE-2018-3988 MEDIUM POC
4.7 Dec 10

Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses th
CVE-2018-16132 HIGH
8.6 Aug 29

The image rendering component (createGenericPreview) of the Open Whisper Signal app through 2.29.0 for iOS fails to chec
CVE-2018-14023 MEDIUM POC
4.0 Aug 20

Open Whisper Signal (aka Signal-Desktop) before 1.15.0-beta.10 allows information leakage. Rated medium severity (CVSS 4
CVE-2023-24069 LOW POC
3.3 Jan 23

Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments

CVE-2018-9840 MEDIUM
6.8 Apr 10

The Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers to bypass the screen locker feat
CVE-2019-9970 MEDIUM
6.5 Mar 24

Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for

CVE-2018-11101 MEDIUM
6.1 May 17

Open Whisper Signal (aka Signal-Desktop) through 1.10.1 allows XSS via a resource location specified in an attribute of

Same weakness CWE-427 – Uncontrolled Search Path Element

View all
CVE-2020-3153 MEDIUM POC
6.5
CVE-2020-3433 HIGH POC
7.8
CVE-2017-6517 CRITICAL POC
9.8
CVE-2020-27955 CRITICAL POC
9.8
CVE-2024-48990 HIGH POC
7.8
CVE-2022-2334 HIGH POC
7.2
CVE-2024-23054 CRITICAL POC
9.8
CVE-2023-31543 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2019-19954 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy