CVE-2019-8385
28Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendepss 20%
from disclosure to weapon0 days
Published on NVDJun 5
1st PoCMar 28
exploitation probability
20%top 3% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
An issue was discovered in Thomson Reuters Desktop Extensions 1.9.0.358. An unauthenticated directory traversal and local file inclusion vulnerability in the ThomsonReuters.Desktop.Service.exe and ThomsonReuters.Desktop.exe allows a remote attacker to list or enumerate sensitive contents of files via a \.. to port 6677. Additionally, this could allow for privilege escalation by dumping the affected machine's SAM and SYSTEM database files, as well as remote code execution.
Affected products
n/a · n/apublic PoCs found — 2
cve_referencepacketstormsecurity.com/files/152298/Thomson-Reuters-Concourse-And-Firm-Central-Local-File-Inclusion-Directory-Traversal.htmlunverifiedexploitdbwww.exploit-db.com/exploits/46615unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.