PT-2021-22143 · Auvesy · Versiondog

Amir Preminger · Published 2021-10-22 · Updated 2021-10-28 · CVE-2021-38469

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Affected product (affected versions not specified)

Description The issue arises from the affected product's services not specifying full paths for the DLLs they load. This allows an attacker to exploit the uncontrolled search path by placing their own DLL near the product's binaries, effectively hijacking the loaded DLL.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2021-38469

Affected Products

Versiondog

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-38469 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38469 · Vendor Advisory
• https://us-cert.cisa.gov/ics/advisories/icsa-21-292-01 · Patch