9.3
CVE-2009-4148
- EPSS 5.49%
- Veröffentlicht 04.12.2009 19:30:00
- Zuletzt bearbeitet 16.06.2026 23:13:07
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginDAZ Studio 2.3.3.161, 2.3.3.163, and 3.0.1.135 allows remote attackers to execute arbitrary JavaScript code via a (1) .ds, (2) .dsa, (3) .dse, or (4) .dsb file, as demonstrated by code that loads the WScript.Shell ActiveX control, related to a "script injection vulnerability."
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Daz3d ≫ Daz Studio Version2.3.3.161
Daz3d ≫ Daz Studio Version2.3.3.163
Daz3d ≫ Daz Studio Version3.0.1.135
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 5.49% | 0.917 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.3 | 8.6 | 10 |
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
CWE-94 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
http://www.coresecurity.com/content/dazstudio-scripting-injection
http://www.securityfocus.com/archive/1/508192/100/0/threaded
http://www.securityfocus.com/bid/37176