Lucene search

[email protected]CVE-2022-27176

HistoryJun 14, 2022 - 9:15 a.m.

CVE-2022-27176

2022-06-1409:15:09

[email protected]

web.nvd.nist.gov

cve-2022-27176

vulnerability

revoworks

file sanitization

macro execution

security

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.9%

JSON

Incomplete filtering of special elements vulnerability exists in RevoWorks SCVX using ‘File Sanitization Library’ 1.043 and prior versions, RevoWorks Browser 2.2.67 and prior versions (when using ‘File Sanitization Option’), and RevoWorks Desktop 2.1.84 and prior versions (when using ‘File Sanitization Option’), which may allow an attacker to execute a malicious macro by having a user to download, import, and open a specially crafted file in the local environment.

Affected configurations

NVD

Node

jscomrevoworks_browserRange<2.2.69

jscomrevoworks_desktopRange<2.1.85

jscomrevoworks_scvxRange<1.0.44

CPENameOperatorVersion
jscom:revoworks_browserjscom revoworks browserlt2.2.69
jscom:revoworks_desktopjscom revoworks desktoplt2.1.85
jscom:revoworks_scvxjscom revoworks scvxlt1.0.44

CPE	Name	Operator	Version
jscom:revoworks_browser	jscom revoworks browser	lt	2.2.69
jscom:revoworks_desktop	jscom revoworks desktop	lt	2.1.85
jscom:revoworks_scvx	jscom revoworks scvx	lt	1.0.44

CNA Affected

[
  {
    "product": "RevoWorks SCVX, RevoWorks Browser, and RevoWorks",
    "vendor": "J’s Communication Co., Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "RevoWorks SCVX using 'File Sanitization Library' 1.043 and prior versions, RevoWorks Browser 2.2.67 and prior versions (when using 'File Sanitization Option'), and RevoWorks Desktop 2.1.84 and prior versions (when using 'File Sanitization Option')"
      }
    ]
  }
]

References

jscom.jp/news-20220527/

jvn.jp/en/jp/JVN27256219/index.html

Social References

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.9%

JSON

Related for CVE-2022-27176

cvelist1 nvd1 prion1 jvn1