PT-2020-19809 · Kaoni · Ezhttptrans

Eunsol Lee · Published 2020-05-28 · Updated 2020-05-28 · CVE-2020-7812

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kaoni ezHTTPTrans versions 1.0.0.70 and prior

Description The issue allows a remote attacker to download arbitrary files by setting specific arguments to an ActiveX method, potentially leading to code execution if the victim's PC is rebooted.

Recommendations For versions 1.0.0.70 and prior, consider disabling the vulnerable ActiveX control until a patch is available. Restrict access to the affected ActiveX method to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-494

Related Identifiers

CVE-2020-7812

Affected Products

Ezhttptrans

References · 5

• http://kaoni.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7812 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7812 · Security Note
• https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35428 · Note
• https://t.me/cvenotify/4066 · Telegram Post