PT-2021-12696 · Unknown · Dext5 Upload

Published 2021-10-28 · Updated 2021-11-01 · CVE-2020-7875

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: DEXT5 Upload versions 5.0.0.117 and earlier

Description: The issue allows a remote attacker to download and execute a remote file by setting the argument variable in the activeX module, which can be leveraged for code execution.

Recommendations: For versions 5.0.0.117 and earlier, consider disabling the activeX module until a patch is available to prevent remote code execution. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the variable in the affected activeX module until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-494

Related Identifiers

CVE-2020-7875

Affected Products

Dext5 Upload

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-7875 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7875 · Vendor Advisory
• https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36312 · Note
• https://t.me/cibsecurity/31402 · Telegram Post