PT-2008-6521 · Flexcell · Flexcell Grid Activex

Published 2008-12-09 · Updated 2017-08-08 · CVE-2008-5404

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FlexCell Grid ActiveX Component version 5.7.0.1

Description The issue allows remote attackers to create and overwrite arbitrary files via the HttpDownloadFile method. This could potentially be leveraged for code execution by creating executable files in Startup folders or by accessing files using hcp:// URLs.

Recommendations For version 5.7.0.1, consider disabling the HttpDownloadFile method until a patch is available to prevent the creation and overwriting of arbitrary files. Restrict access to the FlexCell Grid ActiveX Component to minimize the risk of exploitation. Avoid using the FlexCell Grid ActiveX Component in environments where remote file creation could pose a significant risk.

Fix

Related Identifiers

CVE-2008-5404

Affected Products

Flexcell Grid Activex

References · 4

• http://secunia.com/advisories/32829 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5404 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46809 · Note
• http://securityfocus.com/bid/32443 · Note