PT-2023-3304 · Microsoft · Ms Paint+1

Publicado 2023-05-14 · Atualizado 2023-05-14

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:L/AC:L/Au:S/C:C/I:P/A:C

Name of the Vulnerable Software and Affected Versions Windows (affected versions not specified)

Description The issue is caused by the lack of termination of script execution after an error is detected in the command line interpreter of the Windows operating system. Exploitation of this issue may allow an attacker to execute arbitrary code by creating an image using the standard capabilities of the MS Paint graphic editor.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-390

Identificadores relacionados

BDU:2023-03445

Produtos afetados

Ms Paint

Windows

Referências · 2

• https://tzusec.com/how-to-launch-command-prompt-and-powershell-from-ms-paint · Nota
• https://bdu.fstec.ru/vul/2023-03445 · Nota de Segurança