Lucene search

MitreCVE-2008-4343

HistorySep 30, 2008 - 5:22 p.m.

CVE-2008-4343

2008-09-3017:22:09

CWE-20

mitre

web.nvd.nist.gov

cve-2008-4343

chilkat xml

chilkatutil.ckdata.1

activex control

remote attackers

arbitrary files

execution

remote code execution

hcp:// urls

security vulnerability

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.7

Confidence

Low

EPSS

0.147

Percentile

95.8%

JSON

The Chilkat XML ChilkatUtil.CkData.1 ActiveX control (ChilkatUtil.dll) 3.0.3.0 and earlier allows remote attackers to create, overwrite, and modify arbitrary files for execution via a call to the (1) SaveToFile, (2) SaveToTempFile, or (3) AppendBinary method. NOTE: this issue might only be exploitable in limited environments or non-default browser settings. NOTE: this can be leveraged for remote code execution by accessing files using hcp:// URLs.

Affected configurations

Nvd

Node

chilkat_softwarechilkat_xml_activex_controlRange≤3.0.3.0

VendorProductVersionCPE
chilkat_softwarechilkat_xml_activex_control*cpe:2.3:a:chilkat_software:chilkat_xml_activex_control:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
chilkat_software	chilkat_xml_activex_control	*	cpe:2.3:a:chilkat_software:chilkat_xml_activex_control::::::::

References

secunia.com/advisories/31951

www.securityfocus.com/bid/31332

www.shinnai.net/xplits/TXT_rNowA1916DKFNUF48NyS

exchange.xforce.ibmcloud.com/vulnerabilities/45333

www.exploit-db.com/exploits/6537

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.7

Confidence

Low

EPSS

0.147

Percentile

95.8%

JSON

Related for CVE-2008-4343