PT-2021-2780 · Cscape · Cscape

Sharon Brizinov · Published 2021-04-23 · Updated 2022-10-24 · CVE-2021-22678

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cscape versions prior to 9.90 SP4

Description The issue is related to insufficient validation of user-supplied data when parsing project files, potentially leading to memory corruption. This could allow an attacker to execute code in the context of the current process. The vulnerability can be exploited by a remote attacker to execute arbitrary code.

Recommendations For versions prior to 9.90 SP4, update to version 9.90 SP4 or later to resolve the issue. As a temporary workaround, consider restricting the input of user-supplied data to minimize the risk of exploitation.

Fix

RCE

Memory Corruption

Weakness Enumeration

CWE-20

CWE-787

Related Identifiers

BDU:2021-02323

CVE-2021-22678

Affected Products

Cscape

References · 6

• https://bdu.fstec.ru/vul/2021-02323 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22678 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22678 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2021042322 · Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-112-01 · Note
• https://us-cert.gov/ics/advisories/icsa-21-112-01 · Note