Lucene search

KrcertCVELIST:CVE-2020-7812

HistoryMay 28, 2020 - 1:12 p.m.

CVE-2020-7812 Kaoni ezHTTPTrans Active-X File Download and Execution Vulnerability

2020-05-2813:12:54

CWE-494

krcert

www.cve.org

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.03

Percentile

91.0%

JSON

Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution by rebooting the victim’s PC.

CNA Affected

[
  {
    "product": "ezHTTPTrans",
    "vendor": "Kaoni",
    "versions": [
      {
        "lessThanOrEqual": "1.0.0.90",
        "status": "affected",
        "version": "1.0.0.70",
        "versionType": "custom"
      }
    ]
  }
]

References

www.kaoni.com/

www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35428

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.03

Percentile

91.0%

JSON

Related for CVELIST:CVE-2020-7812