6.5

CVE-2019-17325

EPSS 1.25%
Veröffentlicht 30.10.2019 21:15:12
Zuletzt bearbeitet 21.11.2024 04:32:05
Quelle vuln@krcert.or.kr
CVE-Watchlists
Login
Unerledigt
Login

ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to upload arbitrary local file via the ActiveX method in RexViewerCtrl30.ocx. That could lead to disclosure of sensitive information. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

NVD 1 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Clipsoft ≫ Rexpert Version <= 1.0.0.527

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.25%	0.654

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:P/I:N/A:N

CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35184

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-17325

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-17325

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-17325

EUVD