CVE-2021-33592

2021-07-1905:55:10

CWE-20

naver

www.cve.org

naver toolbar

remote code execution

upgrade.xml file

code signing check

AI Score

9.7

Confidence

High

EPSS

0.012

Percentile

85.3%

JSON

NAVER Toolbar before 4.0.30.323 allows remote attackers to execute arbitrary code via a crafted upgrade.xml file. Special characters in filename parameter can be the cause of bypassing code signing check function.

CNA Affected

[
  {
    "product": "NAVER Toolbar",
    "vendor": "NAVER",
    "versions": [
      {
        "lessThanOrEqual": "4.0.30.323",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

cve.naver.com/detail/cve-2021-33592