When was the CVE record for CVE-2019-12047 published?

The CVE record for CVE-2019-12047 was published on May 13, 2019. That is the record's publication date; the vulnerability itself may have been made public earlier. EchelonGraph's copy of the record carries a last-modified date of November 21, 2024; the record at its source may have been updated since.

Is CVE-2019-12047 actively exploited?

CVE-2019-12047 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 1.2% probability of exploitation in the next 30 days (69th percentile of EPSS-scored CVEs).

What is the CVSS score of CVE-2019-12047?

CVE-2019-12047 has a CVSS v3 base score of 6.1 (NVD).

How do I remediate CVE-2019-12047?

No fix for CVE-2019-12047 has been recorded since its CVE record was published in 2019. If the vendor still supports the product, apply the fixed version it names; if it no longer does, isolate the affected system (restrict network access to it, for example with a firewall, or keep it off the internet) or retire the product.

CVE-2019-12047

MEDIUMNVD 6.16.1

Also known asEUVD-2019-3701 (ENISA EUVD) · GHSA-q4gr-p99g-9293 (GitHub Security Advisories)Source: ENISA EUVD

6.1EG

EchelonGraph verdictMonitorNo fix on record since 2019: if the vendor still supports the product, apply the fixed version it names within your standard update timelines; if it no longer does, isolate the affected system on your normal schedule, or retire the product (the SSVC decision on this page).

Lower severity and no public exploit yet

CISA-KEV: Not listedEPSS PROB: 1.2%CVSS: 6.1Exploit: None knownExposed services: Not assessed

No fix has been recorded since the CVE record was published in 2019 — if the vendor still supports the product, apply the fixed version it names; if not, isolate the affected system (restrict network access to it, for example with a firewall, or keep it off the internet) or retire the product.

Gridea v0.8.0 has an XSS vulnerability through which the Nodejs module can be called to achieve arbitrary code execution, as demonstrated by child_process.exec and the "