Lucene search

CISACISA-KEV-CVE-2024-7262

HistorySep 03, 2024 - 12:00 a.m.

Kingsoft WPS Office Path Traversal Vulnerability

2024-09-0300:00:00

CISA

www.cisa.gov

202

kingsoft wps office

path traversal

vulnerability

promecefpluginhost.exe

windows

attacker

arbitrary windows library

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS4

9.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

PASSIVE

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H/AU:N/RE:L

AI Score

6.9

Confidence

Low

EPSS

0.011

Percentile

85.1%

JSON

Kingsoft WPS Office contains a path traversal vulnerability in promecefpluginhost.exe on Windows that allows an attacker to load an arbitrary Windows library.

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS4

9.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

PASSIVE

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H/AU:N/RE:L

AI Score

6.9

Confidence

Low

EPSS

0.011

Percentile

85.1%

JSON

Related for CISA-KEV-CVE-2024-7262