by Kastro
Paper/Archive/CVE-2021-26618

CVE-2021-26618

TmaxSoft Co., Ltd ToOffice — Tmax ToOffice arbitrary file creation vulnerability

EPSS 1.0%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 62.7.627 × 2012.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An improper input validation leading to arbitrary file creation was discovered in ToWord of ToOffice. Remote attackers use this vulnerability to execute arbitrary file included malicious code.

Affected

ProductAffectedFixed inSource
ToOfficeunspecified – 3.15.5–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
krcert (CNA)7.1CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

refkrcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36456