SB2019101524 - Multiple vulnerabilities in MICROS Relate CRM Software 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019101524

SB2019101524 - Multiple vulnerabilities in MICROS Relate CRM Software

Published: October 15, 2019 Updated: March 7, 2025

Security Bulletin ID SB2019101524
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

High 50% Medium 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Improper input validation (CVE-ID: CVE-2019-2896)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Internal Operations component in MICROS Relate CRM Software. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.


2) OS Command Injection (CVE-ID: CVE-2019-0232)

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to an input validation error within the CGI Servlet when passing arguments from JRE to the Windows environment. A remote attacker can send a specially crafted request to the CGI Servlet, inject and execute arbitrary OS commands on the system with Apache Tomcat privileges.

Successful exploitation of the vulnerability requires that Apache Tomcat is installed on Windows operating system with enabled option “enableCmdLineArguments” (CGI Servlet and “enableCmdLineArguments” option are disabled by default).


Remediation

Install update from vendor's website.

References