CVE-2019-0091: Code Injection
First published: Fri May 17 2019(Updated: )
Code injection vulnerability in installer for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access.
Credit: secure@intel.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Intel Converged Security And Management Engine | >=11.8.0<11.8.65 | |
| Intel Converged Security And Management Engine | >=11.11.0<11.11.65 | |
| Intel Converged Security And Management Engine | >=11.22.0<11.22.65 | |
| Intel Converged Security And Management Engine | >=12.0<12.0.35 | |
| Intel Trusted Execution Technology | >=3.1.0<3.1.65 | |
| Intel Trusted Execution Technology | >=4.0<4.0.15 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-0091?
The severity of CVE-2019-0091 is high with a CVSS score of 7.8.
How does CVE-2019-0091 affect Intel Converged Security And Management Engine?
CVE-2019-0091 affects Intel Converged Security And Management Engine versions 11.8.0 to 11.8.65, 11.11.0 to 11.11.65, 11.22.0 to 11.22.65, and 12.0 to 12.0.35.
How does CVE-2019-0091 affect Intel Trusted Execution Technology?
CVE-2019-0091 affects Intel Trusted Execution Technology versions 3.1.0 to 3.1.65 and 4.0 to 4.0.15.
How can an unprivileged user exploit CVE-2019-0091?
An unprivileged user can potentially enable escalation of privilege via local access.
Is there a fix available for CVE-2019-0091?
Yes, Intel has released updates to address the code injection vulnerability in its installers for Intel(R) CSME and Intel(R) TXE.
- collector/nvd-index
- agent/author
- agent/weakness
- agent/references
- agent/severity
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/event
- agent/type
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/intel
- canonical/intel converged security and management engine
- version/intel converged security and management engine/11.8.0
- version/intel converged security and management engine/11.11.0
- version/intel converged security and management engine/11.22.0
- version/intel converged security and management engine/12.0
- canonical/intel trusted execution technology
- version/intel trusted execution technology/3.1.0
- version/intel trusted execution technology/4.0