PT-2020-19807 · Unknown · Egroupware

Eunsol Lee · Published 2020-08-07 · Updated 2020-08-10 · CVE-2020-7810

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Groupware (affected versions not specified)

Description The issue is related to the hslogin2.dll ActiveX Control in Groupware, which lacks integrity verification of policy files during the update process. This allows a remote attacker to induce a user to visit a crafted web page, potentially leading to malicious code infection by downloading and executing remote files. The attacker can exploit this by setting specific arguments to the ActiveX method.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-353

CWE-354

Related Identifiers

CVE-2020-7810

Affected Products

Egroupware

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-7810 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7810 · Vendor Advisory
• https://krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35551 · Note
• http://handysoft.co.kr/en · Note