CVE-2018-0580

Опубликовано: 14 мая 2018

Источник: nvd

CVSS3: 7.8

CVSS2: 6.8

EPSS Низкий

Описание

Untrusted search path vulnerability in CELSYS, Inc CLIP STUDIO series (CLIP STUDIO PAINT (for Windows) EX/PRO/DEBUT Ver.1.7.3 and earlier, CLIP STUDIO ACTION (for Windows) Ver.1.5.5 and earlier, with its timestamp prior to April 25, 2018, 12:11:31, and CLIP STUDIO MODELER (for Windows) Ver.1.6.3 and earlier, with its timestamp prior to April 25, 2018, 17:02:49) allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.

Ссылки

http://www.clipstudio.net/en/dl
Vendor Advisory
https://jvn.jp/en/jp/JVN68345747/
Third Party Advisory
VDB Entry
https://www.clip-studio.com/clip_site/download/clipstudioaction/csaupdater/index_win
Vendor Advisory
http://www.clipstudio.net/en/dl
Vendor Advisory
https://jvn.jp/en/jp/JVN68345747/
Third Party Advisory
VDB Entry
https://www.clip-studio.com/clip_site/download/clipstudioaction/csaupdater/index_win
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:celsys:clip_studio_action:*:*:*:*:*:windows:*:*

Версия до 1.5.5 (включая)

cpe:2.3:a:celsys:clip_studio_modeler:*:*:*:*:*:windows:*:*

Версия до 1.6.3 (включая)

cpe:2.3:a:celsys:clip_studio_paint:*:*:*:*:*:windows:*:*

Версия до 1.7.3 (включая)

EPSS

Процентиль: 56%

0.0034

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-426

Связанные уязвимости

GHSA-j535-frf7-672m