# Affected Range Fixed in 19.1.8 CVEs with an affected range that ends before version 19.1.8 (exclusive). Source: https://docs.deepinfo.com/reference/vulnerability/search/examples/enrichment-cpe-version-end-excluding/ Last updated: 2026-09-26 --- `POST https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25` CVEs with an affected range that ends before version 19.1.8 (exclusive). Example 9 of 14 in **Filters › Affected Products (CPE)** · [Vulnerability Search Examples](/reference/vulnerability/search/examples/) · endpoint: [Search](/reference/vulnerability/search/) Tags: `field` `enrichment.cpe.version_end_excluding` · `operator` `eq` `enrichment.cpe.version_end_excluding` is the first version that is no longer affected (exclusive), usually the fixed release. `eq` matches the exact value `19.1.8`, whatever the product: GitLab, Adobe Campaign and OPNsense each have a range that ends there. In the response, look at `results[].enrichment.cpe[].version_end_excluding`. ## Request | Parameter | In | Value | |---|---|---| | `page_size` | query | `25` | | `filters.must[0].name` | body | `enrichment.cpe.version_end_excluding` | | `filters.must[0].type` | body | `eq` | | `filters.must[0].value` | body | `19.1.8` | ```bash curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "filters": { "must": [ { "name": "enrichment.cpe.version_end_excluding", "type": "eq", "value": "19.1.8" } ] } }' ``` ## Response ### 200 · OK `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "page": 1, "page_size": 25, "result_count": 3, "results": [ { "id": "CVE-2026-85706", "source_identifier": "user@gitlab.com", "published": "2026-09-12T03:16:30Z", "last_modified": "2026-09-23T22:16:59Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": "2026-09-11", "cisa_action_due": "2026-09-14", "cisa_required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "cisa_vulnerability_name": "GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability", "descriptions": [ { "lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API." } ], "references": [ { "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/627748", "source": "user@gitlab.com", "tags": [ "Broken Link" ] }, { "url": "https://hackerone.com/reports/3909881", "source": "user@gitlab.com", "tags": [ "Permissions Required" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85706", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "Third Party Advisory", "US Government Resource" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@gitlab.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "NONE", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 5.8 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@gitlab.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-22" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "match_criteria_id": "8308AEE0-FFC1-48F0-8E66-E3D6E3EF301E", "version_start_including": "18.7.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "19.1.8" }, { "vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "match_criteria_id": "D19F6592-4940-46BE-A140-BCD284B0EC37", "version_start_including": "18.7.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "19.1.8" }, { "vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "match_criteria_id": "4A6AAECA-E557-43EF-B109-B92D1281E48B", "version_start_including": "19.2.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "19.2.6" }, { "vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "match_criteria_id": "8598AF82-D212-4B5D-ABC3-C12C9B217BF3", "version_start_including": "19.2.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "19.2.6" }, { "vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "match_criteria_id": "198FF0EF-1A45-484F-9268-F7821E006BA8", "version_start_including": "19.3.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "19.3.2" }, { "vulnerable": true, "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "match_criteria_id": "03B1901F-AAF4-421E-B704-5345CB840DEF", "version_start_including": "19.3.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "19.3.2" } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vendor": "gitlab", "product": "gitlab", "product_type": "a", "vulnerable": true, "version_start_including": "18.7.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "19.1.8", "affected_versions_first": "18.7.0", "affected_versions_last": "19.1.7" }, { "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vendor": "gitlab", "product": "gitlab", "product_type": "a", "vulnerable": true, "version_start_including": "18.7.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "19.1.8", "affected_versions_first": "18.7.0", "affected_versions_last": "19.1.7" }, { "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vendor": "gitlab", "product": "gitlab", "product_type": "a", "vulnerable": true, "version_start_including": "19.2.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "19.2.6", "affected_versions_first": "19.2.0", "affected_versions_last": "19.2.5" }, { "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vendor": "gitlab", "product": "gitlab", "product_type": "a", "vulnerable": true, "version_start_including": "19.2.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "19.2.6", "affected_versions_first": "19.2.0", "affected_versions_last": "19.2.5" }, { "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vendor": "gitlab", "product": "gitlab", "product_type": "a", "vulnerable": true, "version_start_including": "19.3.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "19.3.2", "affected_versions_first": "19.3.0", "affected_versions_last": "19.3.1" }, { "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vendor": "gitlab", "product": "gitlab", "product_type": "a", "vulnerable": true, "version_start_including": "19.3.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "19.3.2", "affected_versions_first": "19.3.0", "affected_versions_last": "19.3.1" } ], "cwe": [ { "id": 22, "owasptop10_2021": "A01 Broken Access Control", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "description": "The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.", "capec_id": [ 64, 76, 78, 79, 126 ], "scope": [ "Availability", "Confidentiality", "Integrity" ], "impact": [ "DoS: Crash, Exit, or Restart", "Execute Unauthorized Code or Commands", "Modify Files or Directories", "Read Files or Directories" ], "detection_method": [ "Architecture or Design Review", "Automated Static Analysis", "Automated Static Analysis - Binary or Bytecode", "Automated Static Analysis - Source Code", "Dynamic Analysis with Automated Results Interpretation", "Dynamic Analysis with Manual Results Interpretation", "Manual Static Analysis", "Manual Static Analysis - Binary or Bytecode", "Manual Static Analysis - Source Code" ] } ], "epss_score": { "epss": 0.09287, "percentile": 0.95144, "date": "2026-09-23" }, "cisa_kev": { "vendor_project": "GitLab", "product": "Community Edition and Enterprise Edition", "vulnerability_name": "GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability", "date_added": "2026-09-11", "short_description": "GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API.", "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "due_date": "2026-09-14", "known_ransomware_campaign_use": "Unknown", "notes": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85706" }, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "user@gitlab.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "NONE", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2021-21009", "source_identifier": "user@adobe.com", "published": "2021-01-13T23:15:14Z", "last_modified": "2026-08-24T18:07:51Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "Adobe Campaign Classic Gold Standard 10 (and earlier), 20.3.1 (and earlier), 20.2.3 (and earlier), 20.1.3 (and earlier), 19.2.3 (and earlier) and 19.1.7 (and earlier) are affected by a server-side request forgery (SSRF) vulnerability. Successful exploitation could allow an attacker to use the Campaign instance to issue unauthorized requests to internal or external resources." }, { "lang": "es", "value": "Adobe Campaign Classic Gold Standard versiones 10 (y anteriores), versiones 20.3.1 (y anteriores), versiones 20.2.3 (y anteriores), versiones 20.1.3 (y anteriores), versiones 19.2.3 (y anteriores) y versiones 19.1.7 (y anteriores), están afectados por una vulnerabilidad de tipo server-side request forgery (SSRF). Una explotación con éxito podría permitir a un atacante usar la instancia de Campaign para emitir peticiones no autorizadas hacia recursos internos o externos" } ], "references": [ { "url": "https://helpx.adobe.com/security/products/campaign/apsb21-04.html", "source": "user@adobe.com", "tags": [ "Vendor Advisory" ] }, { "url": "https://helpx.adobe.com/security/products/campaign/apsb21-04.html", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Vendor Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@adobe.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "NONE", "availability_impact": "NONE", "base_score": 8.6, "base_severity": "HIGH", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 4.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "2.0", "vector_string": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "access_vector": "NETWORK", "access_complexity": "LOW", "authentication": "NONE", "confidentiality_impact": "PARTIAL", "integrity_impact": "NONE", "availability_impact": "NONE", "base_score": 5.0, "exploitability": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "collateral_damage_potential": null, "target_distribution": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "environmental_score": null }, "base_severity": "MEDIUM", "exploitability_score": 10.0, "impact_score": 2.9, "ac_insuf_info": false, "obtain_all_privilege": false, "obtain_user_privilege": false, "obtain_other_privilege": false, "user_interaction_required": false } ] }, "weaknesses": [ { "source": "user@adobe.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-918" } ] } ], "configurations": [ { "operator": "AND", "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:campaign:*:*:*:*:standard:*:*:*", "match_criteria_id": "6D9C5CBB-3A6C-4627-B356-25EC2969034D", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "19.1.8" }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:campaign:*:*:*:*:standard:*:*:*", "match_criteria_id": "39508BB1-A036-46A8-BDC9-E687C91C6B9B", "version_start_including": "19.2", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "19.2.4" }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:campaign:*:*:*:*:standard:*:*:*", "match_criteria_id": "9CA5F707-08A3-49A0-81C4-31132A513853", "version_start_including": "20.1", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "20.1.4" }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:campaign:*:*:*:*:standard:*:*:*", "match_criteria_id": "3E3F3DB0-628E-4D91-9D3D-C50D88FCBC24", "version_start_including": "20.2", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "20.2.4" }, { "vulnerable": true, "criteria": "cpe:2.3:a:adobe:campaign:*:*:*:*:standard:*:*:*", "match_criteria_id": "ACF4FEC1-4E3C-4287-AB62-1187108FC697", "version_start_including": "20.3", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "20.3.3" } ] }, { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": false, "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "match_criteria_id": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "match_criteria_id": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:adobe:campaign:*:*:*:*:standard:*:*:*", "vendor": "adobe", "product": "campaign", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "19.1.8", "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:a:adobe:campaign:*:*:*:*:standard:*:*:*", "vendor": "adobe", "product": "campaign", "product_type": "a", "vulnerable": true, "version_start_including": "19.2", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "19.2.4", "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:a:adobe:campaign:*:*:*:*:standard:*:*:*", "vendor": "adobe", "product": "campaign", "product_type": "a", "vulnerable": true, "version_start_including": "20.1", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "20.1.4", "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:a:adobe:campaign:*:*:*:*:standard:*:*:*", "vendor": "adobe", "product": "campaign", "product_type": "a", "vulnerable": true, "version_start_including": "20.2", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "20.2.4", "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:a:adobe:campaign:*:*:*:*:standard:*:*:*", "vendor": "adobe", "product": "campaign", "product_type": "a", "vulnerable": true, "version_start_including": "20.3", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "20.3.3", "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vendor": "linux", "product": "linux_kernel", "product_type": "o", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vendor": "microsoft", "product": "windows", "product_type": "o", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null } ], "cwe": [ { "id": 918, "owasptop10_2021": "A10 Server-Side Request Forgery (SSRF)", "name": "Server-Side Request Forgery (SSRF)", "description": "The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.", "capec_id": [ 664 ], "scope": [ "Access Control", "Confidentiality", "Integrity" ], "impact": [ "Bypass Protection Mechanism", "Execute Unauthorized Code or Commands", "Read Application Data" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.03199, "percentile": 0.8759, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1", "2.0" ], "source": "user@adobe.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "NONE", "vulnerable_system_availability": "NONE", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 8.6, "base_severity": "HIGH" } } } }, { "id": "CVE-2019-11816", "source_identifier": "user@mitre.org", "published": "2019-05-20T22:29:00Z", "last_modified": "2026-06-17T02:13:40Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via a specially crafted request." }, { "lang": "es", "value": "El control de acceso incorrecto en la WebUI en OPNsense antes de la versión 19.1.8, y pfsense antes de 2.4.4-p3 permite a los usuarios autenticados remotos escalar los privilegios a administrador a través de una solicitud especialmente diseñada." } ], "references": [ { "url": "https://forum.opnsense.org/index.php?topic=12787.0", "source": "user@mitre.org", "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://www.netgate.com/blog/pfsense-2-4-4-release-p3-now-available.html", "source": "user@mitre.org", "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://forum.opnsense.org/index.php?topic=12787.0", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Release Notes", "Vendor Advisory" ] }, { "url": "https://www.netgate.com/blog/pfsense-2-4-4-release-p3-now-available.html", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Release Notes", "Vendor Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "HIGH", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 7.2, "base_severity": "HIGH", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 1.2, "impact_score": 5.9 } ], "cvss_metric_v30": null, "cvss_metric_v2": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "2.0", "vector_string": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "access_vector": "NETWORK", "access_complexity": "LOW", "authentication": "SINGLE", "confidentiality_impact": "PARTIAL", "integrity_impact": "PARTIAL", "availability_impact": "PARTIAL", "base_score": 6.5, "exploitability": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "collateral_damage_potential": null, "target_distribution": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "environmental_score": null }, "base_severity": "MEDIUM", "exploitability_score": 8.0, "impact_score": 6.4, "ac_insuf_info": false, "obtain_all_privilege": false, "obtain_user_privilege": false, "obtain_other_privilege": false, "user_interaction_required": false } ] }, "weaknesses": [ { "source": "user@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "NVD-CWE-noinfo" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*", "match_criteria_id": "653BCB44-6584-4779-B8AA-1A46A7E86508", "version_start_including": null, "version_start_excluding": null, "version_end_including": "2.4.4", "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:netgate:pfsense:2.4.4:p1:*:*:*:*:*:*", "match_criteria_id": "E6256A47-F8C7-4097-88D8-170E8E9AE45C", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:netgate:pfsense:2.4.4:p2:*:*:*:*:*:*", "match_criteria_id": "7F038B4C-BC0C-40A8-B547-36F0420CD800", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*", "match_criteria_id": "BD34BEF5-6D4C-40F8-A11B-7A12589D24FB", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "19.1.8" } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*", "vendor": "netgate", "product": "pfsense", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": "2.4.4", "version_end_excluding": null, "affected_versions_first": "2.0", "affected_versions_last": "2.4.4" }, { "criteria": "cpe:2.3:a:netgate:pfsense:2.4.4:p1:*:*:*:*:*:*", "vendor": "netgate", "product": "pfsense", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "2.4.4", "affected_versions_last": "2.4.4" }, { "criteria": "cpe:2.3:a:netgate:pfsense:2.4.4:p2:*:*:*:*:*:*", "vendor": "netgate", "product": "pfsense", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "2.4.4", "affected_versions_last": "2.4.4" }, { "criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*", "vendor": "opnsense", "product": "opnsense", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "19.1.8", "affected_versions_first": "8.1.13", "affected_versions_last": "19.1.7" } ], "cwe": null, "epss_score": { "epss": 0.03212, "percentile": 0.87639, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1", "2.0" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "HIGH", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 7.2, "base_severity": "HIGH" } } } } ] } ``` ## Related Examples - [Affected Range Ending at 2.4.2](/reference/vulnerability/search/examples/enrichment-cpe-version-end-including/) - [First Affected Release 2023.4](/reference/vulnerability/search/examples/enrichment-cpe-affected-versions-first/) - [Affected Range Starting After 6.3](/reference/vulnerability/search/examples/enrichment-cpe-version-start-excluding/) - [Last Affected Release 2026.2](/reference/vulnerability/search/examples/enrichment-cpe-affected-versions-last/) - [Affected Range Starting at 12.5.0](/reference/vulnerability/search/examples/enrichment-cpe-version-start-including/) - [One Release Inside the Affected Range](/reference/vulnerability/search/examples/enrichment-cpe-affected-versions/)