Lucene search

KrcertCVE-2020-7812

HistoryMay 28, 2020 - 2:15 p.m.

CVE-2020-7812

2020-05-2814:15:11

CWE-494

krcert

web.nvd.nist.gov

cve-2020-7812

ezhttptrans.ocx

activex control

kaoni

vulnerability

remote attacker

arbitrary file download

code execution

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.03

Percentile

91.0%

JSON

Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution by rebooting the victim’s PC.

Affected configurations

Nvd

Node

microsoftwindowsMatch-

AND

kaoniezhttptransRange≤1.0.0.70

VendorProductVersionCPE
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
kaoniezhttptrans*cpe:2.3:a:kaoni:ezhttptrans:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*
kaoni	ezhttptrans	*	cpe:2.3:a:kaoni:ezhttptrans::::::::

CNA Affected

[
  {
    "product": "ezHTTPTrans",
    "vendor": "Kaoni",
    "versions": [
      {
        "lessThanOrEqual": "1.0.0.90",
        "status": "affected",
        "version": "1.0.0.70",
        "versionType": "custom"
      }
    ]
  }
]

References

www.kaoni.com/

www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35428

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.03

Percentile

91.0%

JSON

Related for CVE-2020-7812