CVE-2022-27965 : Xlpd v7.0.0094 and below contains a binary hijack vulnerability which allows att

Xlpd v7.0.0094 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.

Published 2022-03-31 23:15:09

Updated 2022-04-08 14:57:10

Source MITRE

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2022-27965

Netsarang » Xlpd
Versions up to, including, (<=) 7.0.0094
cpe:2.3:a:netsarang:xlpd:*:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows » Version: N/A

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.9	MEDIUM	AV:L/AC:M/Au:N/C:C/I:C/A:C	3.4	10.0	NIST
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
6.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H	0.6	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-428 Unquoted Search Path or Element

The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.

Assigned by: nvd@nist.gov (Primary)

https://www.netsarang.com/en/xlpd-update-history/

Xlpd Update History - NetSarang Website
Release Notes;Vendor Advisory

CVEs referencing this url
https://github.com/ycdxsb/Vuln/tree/main/NetSarang-CreateProcessW-Misuse-Binary-Hijack/Xlpd-CreateProcessW-Misuse-Binary-Hijack

Vuln/NetSarang-CreateProcessW-Misuse-Binary-Hijack/Xlpd-CreateProcessW-Misuse-Binary-Hijack at main · ycdxsb/Vuln · GitHub
Exploit;Third Party Advisory

Jump to