CVE-2017-2208

EPSS 0.51%
Veröffentlicht 07.07.2017 13:29:00
Zuletzt bearbeitet 20.04.2025 01:37:25
Quelle vultures@jpcert.or.jp
CVE-Watchlists
Login
Unerledigt
Login

Untrusted search path vulnerability in Installer of Electronic tendering and bid opening system available prior to June 12, 2017 allows an attacker to execute arbitrary code via a specially crafted executable file in an unspecified directory.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Acquisition Technology And Logistics Agency ≫ Installer Of Electronic Tendering Version <= 06112017

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.51%	0.653

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.8	1.8	5.9	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-426 Untrusted Search Path

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

http://www.mod.go.jp/atla/souhon/cals/nyusatsu_top.html

Vendor Advisory

https://jvn.jp/en/jp/JVN27198823/index.html

Third Party Advisory

VDB Entry

https://nvd.nist.gov/vuln/detail/CVE-2017-2208

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2017-2208

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2017-2208

EUVD