PT-2017-11554 · Fuji Xerox · Docuworks+1

Published 2017-09-01 · Updated 2017-09-06 · CVE-2017-10848

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions DocuWorks versions 8.0.7 and earlier DocuWorks Viewer Light versions published in Jul 2017 and earlier

Description The issue allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. This is due to an untrusted search path vulnerability in the installers for the affected software.

Recommendations For DocuWorks versions 8.0.7 and earlier, update to a version later than 8.0.7 to resolve the issue. For DocuWorks Viewer Light versions published in Jul 2017 and earlier, update to a version published after Jul 2017 to resolve the issue.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2017-10848

Affected Products

Docuworks

Docuworks Viewer Light

References · 4

• http://fujixerox.co.jp/company/news/notice/2017/0831_rectification_work.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-10848 · Security Note
• https://osv.dev/vulnerability/CVE-2017-10848 · Vendor Advisory
• https://jvn.jp/en/jp/JVN09769017/index.html · Note