PT-2015-3487 · Cygnicon+1 · Cyviewer.Ocx+1

Publicado 2015-01-01 · Atualizado 2015-01-03 · CVE-2011-5291

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ashampoo 3D CAD Professional versions prior to 3.0.2

Description The issue allows remote attackers to write to arbitrary files. This is achieved by providing a pathname in the first argument to the SaveData method in the Cygnicon.ViewControl.1 ActiveX control in CyViewer.ocx.

Recommendations For versions prior to 3.0.2, update to version 3.0.2 or later to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2011-5291

Produtos afetados

Ashampoo 3D Cad Professional

Cyviewer.Ocx

Referências · 2

• 🔥 https://htbridge.com/advisory/HTB23019 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-5291 · Nota de Segurança