by Kastro
Paper/Archive/CVE-2020-7882

CVE-2020-7882

Hancomwith anySign4PC — anySign directory traversal vulnerability

EPSS 1%CVSS 9.1
critical.is priorityof 100
41
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 70.5.705 × 2014.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Using the parameter of getPFXFolderList function, attackers can see the information of authorization certification and delete the files. It occurs because the parameter contains path traversal characters(ie. '../../../')

Affected

ProductAffectedFixed inSource
anySign4PC1.1.1.0–CNA
anySign4PC1.1.2.6–CNA
anySign4PC1.1.2.7–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
krcert (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

refboho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36344