{"cve":"CVE-2019-5029","nvd":{"published":"2019-11-13T23:15:12.153","modified":"2026-06-17T02:37:00.433","status":"Modified","description":"An exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.7.1. Arbitrary shell commands surrounded by backticks or $() can be inserted into the editor and will be executed by the Exhibitor process when it launches ZooKeeper. An attacker can execute any command as the user running the Exhibitor process.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-78"],"references":["https://talosintelligence.com/vulnerability_reports/TALOS-2019-0790","https://talosintelligence.com/vulnerability_reports/TALOS-2019-0790"],"products":["exhibitor_project:exhibitor"],"source":"nvd","synced_at":"2026-10-19T20:59:25.448946135+00:00"},"epss":{"cve":"CVE-2019-5029","score":0.5715,"percentile":0.99072,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}