CVE-2021-26612
Assigner: krcert
Published: 2021-11-30T18:39:25
State: PUBLISHED
affected: platforms: Windows
product: NEXACRO17
vendor: TOBESOFT
versions: lessThanOrEqual: 17.1.2.500
status: affected
version: 17.1.2.500
versionType: custom
descriptions: value: An improper input validation leading to arbitrary file creation was discovered in copy method of Nexacro platform. Remote attackers use copy method to execute arbitrary command after the file creation included malicious code.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-20
description: CWE-20 Improper Input Validation
type: CWE
source: discovery: UNKNOWN
title: tobesoft Nexacro platform arbitrary file creation vulnerability
x_generator: engine: Vulnogram 0.0.9