CVE-2021-37444

Name of the Vulnerable Software and Affected Versions NCH IVM Attendant versions 5.12 and earlier

Description The issue is related to a directory traversal weakness when uploading plugins in a ZIP archive. This weakness can lead to code execution if a ZIP element's pathname is set to a Windows startup folder, a file for the inbuilt Out-Going Message function, or a file for the inbuilt Autodial function.

Recommendations For versions 5.12 and earlier, consider disabling the plugin upload feature until a patch is available to prevent potential code execution. Restrict access to the ZIP archive upload functionality to minimize the risk of exploitation. Avoid using the pathname parameter in the ZIP element to prevent directory traversal.