PT-2022-21195
CVE-2022-32270
·
تاريخ النشر
2022-06-03
·
تاريخ التحديث
2022-06-12
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Real Player versions 20.0.7.309 through 20.0.8.310
Description
The issue allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution. This occurs because it is possible to plant executables in the startup folder, and DLL planting could also occur. The
external::Import() function is involved in this issue.Recommendations
For versions 20.0.7.309 and 20.0.8.310, consider disabling the
external::Import() function until a patch is available to prevent the download of arbitrary file types and Directory Traversal. Restrict access to the startup folder to minimize the risk of planting executables. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾