Medium severity · published Nov 26, 2019
CVE-2019-15687
Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the…
6.5
CVSS
1.6%
EPSS
No
On KEV
Description
Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component was vulnerable to remote disclosure of various information about the user's system (like Windows version and version of the product, host unique ID). Information Disclosure.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Anti-virus · Kaspersky
through 2020; through 2020 · source: NVD
IS
Internet Security · Kaspersky
through 2020 · source: NVD
SC
Security Cloud · Kaspersky
through 2020 · source: NVD
SO
Small Office Security · Kaspersky
through 7 · source: NVD
TS
Total Security · Kaspersky
through 2020 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-15687
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-15687
Vendor Advisory
https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1
More from Anti-virus
9.8
CVE-2022-27534
Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March 2022 had a bug in a data parsing module that potentially…
6.1
CVE-2019-15688
Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the…
5.5
CVE-2021-27223
A denial-of-service issue existed in one of modules that was incorporated in Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security
5.5
CVE-2016-4329
A local denial of service vulnerability exists in window broadcast message handling functionality of Kaspersky Anti-Virus software
4.3
CVE-2019-15686
Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the…