CVE-2022-32270

Name of the Vulnerable Software and Affected Versions Real Player versions 20.0.7.309 through 20.0.8.310

Description The issue allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution. This occurs because it is possible to plant executables in the startup folder, and DLL planting could also occur. The external::Import() function is involved in this issue.

Recommendations For versions 20.0.7.309 and 20.0.8.310, consider disabling the external::Import() function until a patch is available to prevent the download of arbitrary file types and Directory Traversal. Restrict access to the startup folder to minimize the risk of planting executables.