CVE-2018-6306 : Unauthorized code execution from specific DLL and is known as DLL Hijacking atta

Unauthorized code execution from specific DLL and is known as DLL Hijacking attack in Kaspersky Password Manager versions before 8.0.6.538.

Published 2018-04-19 13:29:00

Updated 2018-05-22 14:38:11

Source Kaspersky Labs

View at NVD, CVE.org

Vulnerability category: File inclusion

Products affected by CVE-2018-6306

Kaspersky » Password Manager
Versions before (<) 8.0.6.538
cpe:2.3:a:kaspersky:password_manager:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 42 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-426 Untrusted Search Path

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

Assigned by: nvd@nist.gov (Primary)

Jump to