Read the docs
TI-2019-09326 Aliases CVE-2019-12491GHSA-4hwf-q27j-2mmh

OnApp before 5.0.0-88, 5.5.0-93, and 6.0.0-196 allows an attacker to run arbitrary…

Priority LOW 32Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

OnApp before 5.0.0-88, 5.5.0-93, and 6.0.0-196 allows an attacker to run arbitrary commands with root privileges on servers managed by OnApp for XEN/KVM hypervisors. To exploit the vulnerability an attacker has to have control of a single server on a given cloud (e.g. by renting one). From the source server, the attacker can craft any command and trigger the OnApp platform to execute that command with root privileges on a target server.

Why it matters now

EPSS 0.01505 74th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 40

CPEVersionsRoleVendor
cpe:2.3:a:onapp:onapp:5.0.0:-:*:*:*:*:*:*5.0.0VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.0.0:update_79:*:*:*:*:*:*5.0.0 update_79VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.0.0:update_82:*:*:*:*:*:*5.0.0 update_82VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.0.0:update_83:*:*:*:*:*:*5.0.0 update_83VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.0.0:update_87:*:*:*:*:*:*5.0.0 update_87VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.1.0:-:*:*:*:*:*:*5.1.0VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.1.0:update_16:*:*:*:*:*:*5.1.0 update_16VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.2.0:-:*:*:*:*:*:*5.2.0VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.3.0:-:*:*:*:*:*:*5.3.0VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.3.0:update_41:*:*:*:*:*:*5.3.0 update_41VulnerableOnapp
  • cpe:2.3:a:onapp:onapp:5.0.0:-:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.0.0:update_79:*:*:*:*:*:* Versions 5.0.0 update_79 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.0.0:update_82:*:*:*:*:*:* Versions 5.0.0 update_82 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.0.0:update_83:*:*:*:*:*:* Versions 5.0.0 update_83 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.0.0:update_87:*:*:*:*:*:* Versions 5.0.0 update_87 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.1.0:-:*:*:*:*:*:* Versions 5.1.0 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.1.0:update_16:*:*:*:*:*:* Versions 5.1.0 update_16 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.2.0:-:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.3.0:-:*:*:*:*:*:* Versions 5.3.0 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.3.0:update_41:*:*:*:*:*:* Versions 5.3.0 update_41 Vulnerable ·Onapp
Show 30 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:onapp:onapp:5.4.0:-:*:*:*:*:*:*5.4.0VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.4.0:update_66:*:*:*:*:*:*5.4.0 update_66VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.4.0:update_70:*:*:*:*:*:*5.4.0 update_70VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.4.0:update_72:*:*:*:*:*:*5.4.0 update_72VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.4.0:update_76:*:*:*:*:*:*5.4.0 update_76VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.4.0:update_82:*:*:*:*:*:*5.4.0 update_82VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.4.0:update_84:*:*:*:*:*:*5.4.0 update_84VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.5.0:-:*:*:*:*:*:*5.5.0VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.5.0:update_50:*:*:*:*:*:*5.5.0 update_50VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.5.0:update_59:*:*:*:*:*:*5.5.0 update_59VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.5.0:update_65:*:*:*:*:*:*5.5.0 update_65VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.5.0:update_75:*:*:*:*:*:*5.5.0 update_75VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.5.0:update_80:*:*:*:*:*:*5.5.0 update_80VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.5.0:update_83:*:*:*:*:*:*5.5.0 update_83VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.5.0:update_87:*:*:*:*:*:*5.5.0 update_87VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.5.0:update_90:*:*:*:*:*:*5.5.0 update_90VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.5.0:update_92:*:*:*:*:*:*5.5.0 update_92VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.6.0:-:*:*:*:*:*:*5.6.0VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.6.0:update_83:*:*:*:*:*:*5.6.0 update_83VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.7.0:-:*:*:*:*:*:*5.7.0VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.8.0:-:*:*:*:*:*:*5.8.0VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.9.0:-:*:*:*:*:*:*5.9.0VulnerableOnapp
cpe:2.3:a:onapp:onapp:5.10.0:-:*:*:*:*:*:*5.10.0VulnerableOnapp
cpe:2.3:a:onapp:onapp:6.0:update_122:*:*:*:*:*:*6.0 update_122VulnerableOnapp
cpe:2.3:a:onapp:onapp:6.0:update_152:*:*:*:*:*:*6.0 update_152VulnerableOnapp
cpe:2.3:a:onapp:onapp:6.0:update_159:*:*:*:*:*:*6.0 update_159VulnerableOnapp
cpe:2.3:a:onapp:onapp:6.0:update_62:*:*:*:*:*:*6.0 update_62VulnerableOnapp
cpe:2.3:a:onapp:onapp:6.0:update_80:*:*:*:*:*:*6.0 update_80VulnerableOnapp
cpe:2.3:a:onapp:onapp:6.0:update_98:*:*:*:*:*:*6.0 update_98VulnerableOnapp
cpe:2.3:a:onapp:onapp:6.0.0:-:*:*:*:*:*:*6.0.0VulnerableOnapp
  • cpe:2.3:a:onapp:onapp:5.4.0:-:*:*:*:*:*:* Versions 5.4.0 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.4.0:update_66:*:*:*:*:*:* Versions 5.4.0 update_66 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.4.0:update_70:*:*:*:*:*:* Versions 5.4.0 update_70 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.4.0:update_72:*:*:*:*:*:* Versions 5.4.0 update_72 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.4.0:update_76:*:*:*:*:*:* Versions 5.4.0 update_76 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.4.0:update_82:*:*:*:*:*:* Versions 5.4.0 update_82 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.4.0:update_84:*:*:*:*:*:* Versions 5.4.0 update_84 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.5.0:-:*:*:*:*:*:* Versions 5.5.0 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.5.0:update_50:*:*:*:*:*:* Versions 5.5.0 update_50 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.5.0:update_59:*:*:*:*:*:* Versions 5.5.0 update_59 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.5.0:update_65:*:*:*:*:*:* Versions 5.5.0 update_65 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.5.0:update_75:*:*:*:*:*:* Versions 5.5.0 update_75 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.5.0:update_80:*:*:*:*:*:* Versions 5.5.0 update_80 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.5.0:update_83:*:*:*:*:*:* Versions 5.5.0 update_83 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.5.0:update_87:*:*:*:*:*:* Versions 5.5.0 update_87 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.5.0:update_90:*:*:*:*:*:* Versions 5.5.0 update_90 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.5.0:update_92:*:*:*:*:*:* Versions 5.5.0 update_92 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.6.0:-:*:*:*:*:*:* Versions 5.6.0 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.6.0:update_83:*:*:*:*:*:* Versions 5.6.0 update_83 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.7.0:-:*:*:*:*:*:* Versions 5.7.0 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.8.0:-:*:*:*:*:*:* Versions 5.8.0 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.9.0:-:*:*:*:*:*:* Versions 5.9.0 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:5.10.0:-:*:*:*:*:*:* Versions 5.10.0 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:6.0:update_122:*:*:*:*:*:* Versions 6.0 update_122 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:6.0:update_152:*:*:*:*:*:* Versions 6.0 update_152 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:6.0:update_159:*:*:*:*:*:* Versions 6.0 update_159 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:6.0:update_62:*:*:*:*:*:* Versions 6.0 update_62 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:6.0:update_80:*:*:*:*:*:* Versions 6.0 update_80 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:6.0:update_98:*:*:*:*:*:* Versions 6.0 update_98 Vulnerable ·Onapp
  • cpe:2.3:a:onapp:onapp:6.0.0:-:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Onapp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-12491
  2. 2026-10-03 Alias added: GHSA-4hwf-q27j-2mmh

References

Patch 1

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences