PT-2021-12702 · Hancomwith+1 · Anysign4Pc

Published 2021-11-22 · Updated 2021-11-26 · CVE-2020-7882

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions.

Description: The issue allows attackers to view authorization certification information and delete files by exploiting the getPFXFolderList function. This is possible because the parameter of this function can contain path traversal characters, such as '../../../'.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-24

CWE-22

Related Identifiers

CVE-2020-7882

Affected Products

Anysign4Pc

References · 5

• https://osv.dev/vulnerability/CVE-2020-7882 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7882 · Security Note
• https://t.me/cvenotify/23792 · Telegram Post
• https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36344 · Note
• https://t.me/cibsecurity/32790 · Telegram Post