exploitDog

CVE-2007-6753

Опубликовано: 28 мар. 2012

Источник: nvd

CVSS2: 6.2

EPSS Низкий

Описание

Untrusted search path vulnerability in Shell32.dll in Microsoft Windows 2000, Windows XP, Windows Vista, Windows Server 2008, and Windows 7, when using an environment configured with a string such as %APPDATA% or %PROGRAMFILES% in a certain way, allows local users to gain privileges via a Trojan horse DLL under the current working directory, as demonstrated by iTunes and Safari.

Комментарий

Per: http://cwe.mitre.org/data/definitions/426.html

'CWE-426: Untrusted Search Path'

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:microsoft:windows_2000:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:*:*:*:*:*:*:*:*

EPSS

Процентиль: 80%

0.01387

Низкий

6.2 Medium

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

GHSA-3683-m793-hh38

github

почти 4 года назад

Untrusted search path vulnerability in Shell32.dll in Microsoft Windows 2000, Windows XP, Windows Vista, Windows Server 2008, and Windows 7, when using an environment configured with a string such as %APPDATA% or %PROGRAMFILES% in a certain way, allows local users to gain privileges via a Trojan horse DLL under the current working directory, as demonstrated by iTunes and Safari.

EPSS

Процентиль: 80%

0.01387

Низкий

6.2 Medium

CVSS2

Дефекты

NVD-CWE-Other