PT-2021-21657
CVE-2021-37444
·
تاريخ النشر
2021-07-25
·
تاريخ التحديث
2021-07-30
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
NCH IVM Attendant versions 5.12 and earlier
Description
The issue is related to a directory traversal weakness when uploading plugins in a ZIP archive. This weakness can lead to code execution if a ZIP element's pathname is set to a Windows startup folder, a file for the inbuilt Out-Going Message function, or a file for the inbuilt Autodial function.
Recommendations
For versions 5.12 and earlier, consider disabling the plugin upload feature until a patch is available to prevent potential code execution. Restrict access to the ZIP archive upload functionality to minimize the risk of exploitation. Avoid using the pathname parameter in the ZIP element to prevent directory traversal.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾