Lucene search

KrcertCVELIST:CVE-2021-26630

HistoryMay 19, 2022 - 2:52 p.m.

CVE-2021-26630 HANDY Groupware file download and execute vulnerability

2022-05-1914:52:27

CWE-20

krcert

www.cve.org

improper input validation

handy groupware

file download

execution

vulnerability

activex module

parameter value

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.003

Percentile

71.9%

JSON

Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbitrary files. This vulnerability can be exploited by using the file download or execution path as the parameter value of the vulnerable function.

CNA Affected

[
  {
    "platforms": [
      "Windows"
    ],
    "product": "HANDY Groupware",
    "vendor": "Handysoft Co.,Ltd",
    "versions": [
      {
        "lessThanOrEqual": "1.7.4.6",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "Windows"
    ],
    "product": "HANDY Groupware",
    "vendor": "Handysoft Co.,Ltd",
    "versions": [
      {
        "lessThanOrEqual": "2.0.3.6",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "platforms": [
      "Windows"
    ],
    "product": "HANDY Groupware",
    "vendor": "Handysoft Co.,Ltd",
    "versions": [
      {
        "lessThanOrEqual": "4.0.1.7",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66723

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.003

Percentile

71.9%

JSON

Related for CVELIST:CVE-2021-26630