PT-2022-7990 · Viscosity · Viscosity

Kacper Szurek · Published 2022-06-30 · Updated 2022-07-09 · CVE-2017-20123

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Viscosity version 1.6.7

Description A critical issue affects an unknown part of the component DLL Handler, leading to an untrusted search path. The manipulation can be initiated remotely. The issue has been disclosed publicly.

Recommendations For Viscosity version 1.6.7, upgrade to version 1.6.8 to address this issue.

Exploit

Fix

Untrusted Search Path

Uncontrolled Search Path Element

Weakness Enumeration

CWE-426

CWE-427

Related Identifiers

CVE-2017-20123

Affected Products

Viscosity

References · 8

• 🔥 https://github.com/kacperszurek/exploits/tree/master/Viscosity · Exploit
• https://sparklabs.com/blog/viscosity-for-mac-windows-version-1-6-8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-20123 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-20123 · Security Note
• http://seclists.org/fulldisclosure/2017/Feb/1 · Note
• https://t.me/cibsecurity/45395 · Telegram Post
• https://vuldb.com/?id.96639 · Note
• https://t.me/cvenotify/32410 · Telegram Post