PT-2008-6521 · Flexcell · Flexcell Grid Activex

Publicado 2008-12-09 · Atualizado 2017-08-08 · CVE-2008-5404

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FlexCell Grid ActiveX Component version 5.7.0.1

Description The issue allows remote attackers to create and overwrite arbitrary files via the HttpDownloadFile method. This could potentially be leveraged for code execution by creating executable files in Startup folders or by accessing files using hcp:// URLs.

Recommendations For version 5.7.0.1, consider disabling the HttpDownloadFile method until a patch is available to prevent the creation and overwriting of arbitrary files. Restrict access to the FlexCell Grid ActiveX Component to minimize the risk of exploitation. Avoid using the FlexCell Grid ActiveX Component in environments where remote file creation could pose a significant risk.

Correção

Identificadores relacionados

CVE-2008-5404

Produtos afetados

Flexcell Grid Activex

Referências · 4

• http://secunia.com/advisories/32829 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46809 · Nota
• http://securityfocus.com/bid/32443 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-5404 · Nota de Segurança