Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2019-18956: Divisa Proxia Suite 9 < 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 < 10.0.32, and 10.1 < 10.1.5

68
This week
CRITICAL 9.8REMOTEUPGRADEUPGRADEUPGRADE

CVE-2019-18956 is a critical-severity flaw (CVSS 9.8) affecting dv2eemvc, proxia phr, proxia suite. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Divisa Proxia Suite 9 < 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 < 10.0.32, and 10.1 < 10.1.5, SparkSpace 1.0 < 1.0.30, 1.1 < 1.1.2, and 1.2 < 1.2.4, and Proxia PHR 1.0 < 1.0.30 and 1.1 < 1.1.2 allows remote code execution via untrusted Java deserialization. The proxia-error cookie is insecurely deserialized in every request (GET or POST). Thus, an unauthenticated attacker can easily craft a seria1.0lized payload in order to exec

Why this priority

  • Critical severity
  • EPSS top 7%: very likely to be exploited
  • Public exploit reference
  • Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score9.8 (Critical)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance5.8% (top 7%)
CISA exploited listNo
WeaknessCWE-502
Published2019-12-17
Last modified2026-06-17
Publisher (CNA): MITRE · Vendor: divisait

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

divisait dv2eemvc UPGRADE
Affected: >= 17-62 and <= 17-147 · >= 18.6 and < 18.6.42 · >= 19.0 and < 19.0.13 · >= 19.1 and < 19.1.19 · >= 19.2 and < 19.2.41 · >= 19.3 and < 19.3.37 · >= 19.4 and < 19.4.13 · >= 20.0 and < 20.0.13
Fixed in: 18.6.42, 19.0.13, 19.1.19, 19.2.41, 19.3.37, 19.4.13, 20.0.13
Safe to downgrade to: a release before 17-62
1. Check installed version
apt-cache policy dv2eemvc || rpm -q dv2eemvc || dv2eemvc --version
2. UPGRADE to 18.6.42 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade dv2eemvc
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade dv2eemvc
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 17-62 (Debian / Ubuntu)
apt-cache madison dv2eemvc sudo apt install dv2eemvc=<VERSION_BEFORE_17-62> sudo apt-mark hold dv2eemvc
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list dv2eemvc sudo dnf downgrade dv2eemvc-<VERSION_BEFORE_17-62> sudo dnf versionlock add dv2eemvc
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
divisait proxia phr UPGRADE
Affected: >= 1.0 and < 1.0.30 · >= 1.1 and < 1.1.2
Fixed in: 1.0.30, 1.1.2
Safe to downgrade to: a release before 1.0
1. Check installed version
apt-cache policy proxia-phr || rpm -q proxia-phr || proxia-phr --version
2. UPGRADE to 1.0.30 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade proxia-phr
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade proxia-phr
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 1.0 (Debian / Ubuntu)
apt-cache madison proxia-phr sudo apt install proxia-phr=<VERSION_BEFORE_1.0> sudo apt-mark hold proxia-phr
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list proxia-phr sudo dnf downgrade proxia-phr-<VERSION_BEFORE_1.0> sudo dnf versionlock add proxia-phr
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
divisait proxia suite UPGRADE
Affected: >= 9.0 and < 9.12.16 · >= 10.0 and < 10.0.32 · >= 10.1 and < 10.1.5
Fixed in: 9.12.16, 10.0.32, 10.1.5
Safe to downgrade to: a release before 9.0
1. Check installed version
apt-cache policy proxia-suite || rpm -q proxia-suite || proxia-suite --version
2. UPGRADE to 9.12.16 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade proxia-suite
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade proxia-suite
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 9.0 (Debian / Ubuntu)
apt-cache madison proxia-suite sudo apt install proxia-suite=<VERSION_BEFORE_9.0> sudo apt-mark hold proxia-suite
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list proxia-suite sudo dnf downgrade proxia-suite-<VERSION_BEFORE_9.0> sudo dnf versionlock add proxia-suite
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
divisait sparkspace UPGRADE
Affected: >= 1.0 and < 1.0.30 · >= 1.1 and < 1.1.2 · >= 1.2 and < 1.2.4
Fixed in: 1.0.30, 1.1.2, 1.2.4
Safe to downgrade to: a release before 1.0
1. Check installed version
apt-cache policy sparkspace || rpm -q sparkspace || sparkspace --version
2. UPGRADE to 1.0.30 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade sparkspace
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade sparkspace
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 1.0 (Debian / Ubuntu)
apt-cache madison sparkspace sudo apt install sparkspace=<VERSION_BEFORE_1.0> sudo apt-mark hold sparkspace
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list sparkspace sudo dnf downgrade sparkspace-<VERSION_BEFORE_1.0> sudo dnf versionlock add sparkspace
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2019-18956?

dv2eemvc: upgrade to 18.6.42, 19.0.13, 19.1.19, 19.2.41, 19.3.37, 19.4.13, 20.0.13; proxia phr: upgrade to 1.0.30, 1.1.2; proxia suite: upgrade to 9.12.16, 10.0.32, 10.1.5. Exact commands for each OS are on this page.

Is CVE-2019-18956 being exploited?

CVE-2019-18956 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2019-18956 affect?

CVE-2019-18956 affects dv2eemvc, proxia phr, proxia suite. Severity is critical (CVSS 9.8). Divisa Proxia Suite 9 < 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 < 10.0.32, and 10.1 < 10.1.5, SparkSpace 1.0 < 1.0.30, 1.1 < 1.1.2, and 1.2 < 1.2.4, and Proxia PHR 1.0 < 1.0.30 and 1.1 < 1.1.2 allows remote code execution

How urgent is CVE-2019-18956?

Priority 68/100. Critical severity; EPSS top 7%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action

Software pages

Java vulnerabilities

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.