CVE-2018-6461

Опубликовано: 05 фев. 2018

Источник: nvd

CVSS3: 7.8

CVSS2: 9.3

EPSS Низкий

Описание

March Hare WINCVS before 2.8.01 build 6610, and CVS Suite before 2009R2 build 6610, contains an Insecure Library Loading vulnerability in the wincvs2.exe or wincvs.exe file, which may allow local users to gain privileges via a Trojan horse Python or TCL DLL file in the current working directory.

Ссылки

http://hyp3rlinx.altervista.org/advisories/CVS-SUITE-2009R2-INSECURE-LIBRARY-LOADING-CVE-2018-6461.txt
Exploit
Third Party Advisory
http://march-hare.com/cvspro/vulnwincvs.htm
Vendor Advisory
http://packetstormsecurity.com/files/146267/WINCVS-2009R2-DLL-Hijacking.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2018/Feb/24
Exploit
Mailing List
Third Party Advisory
http://hyp3rlinx.altervista.org/advisories/CVS-SUITE-2009R2-INSECURE-LIBRARY-LOADING-CVE-2018-6461.txt
Exploit
Third Party Advisory
http://march-hare.com/cvspro/vulnwincvs.htm
Vendor Advisory
http://packetstormsecurity.com/files/146267/WINCVS-2009R2-DLL-Hijacking.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2018/Feb/24
Exploit
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:march-hare:wincvs:*:*:*:*:*:*:*:*

Версия от 1.0 (включая) до 2.8.01 (исключая)

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

EPSS

Процентиль: 33%

0.00134

Низкий

7.8 High

CVSS3

9.3 Critical

CVSS2

Дефекты

CWE-426

Связанные уязвимости

GHSA-xqj3-xhhm-rh7c