PT-2024-22281 · Easyrange · Easyrange

Published 2024-03-26 · Updated 2024-08-02 · CVE-2024-28131

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EasyRange Ver 1.41

Description The issue with the executable file search path when displaying an extracted file on Explorer may lead to loading an executable file that resides in the same folder where the extracted file is placed. If this issue is exploited, arbitrary code may be executed with the privilege of the running program. The developer was unreachable, and users should consider stopping the use of EasyRange Ver 1.41.

Recommendations For EasyRange Ver 1.41, consider stopping the use of this version as the developer is unreachable and no fix is available. As a temporary workaround, consider restricting access to the executable file search path to minimize the risk of exploitation. Avoid using EasyRange Ver 1.41 to display extracted files on Explorer until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2024-28131

Affected Products

Easyrange

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-28131 · Security Note
• https://twitter.com/VulmonFeeds/status/1772598924408164371 · Twitter Post
• https://twitter.com/RedPacketSec/status/1772564974906278087 · Twitter Post
• https://twitter.com/CVEnew/status/1772562210734141584 · Twitter Post
• https://t.me/cvenotify/74662 · Telegram Post
• https://twitter.com/oktsec/status/1773848058389733466 · Twitter Post
• https://jvn.jp/en/jp/JVN13113728/index.html · Note