CVE-2020-25845 - CHANGING Inc. NHIServiSignAdapter Windows Versions

Back Back to CVE browser

HIGH

CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -1

Published Dec 31, 2020

7.5

HIGH

CVSS 3.1

EPSS 0.97%

Description

Multiple functions of NHIServiSignAdapter failed to verify the users’ file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user's credential.

Affected products

Vendor CHANGING Inc. Product NHIServiSignAdapter Default
n/a
- Version
  1.0.20.0218
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

CHANGING Inc.

NHIServiSignAdapter

n/a

Version	Status	Constraints
1.0.20.0218	affected	-

Remediation

Vendor solution

Update to version 1.0.20.1109

Weaknesses (1)

CWE-601

Open Redirect

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-18478
Advisory
https://www.twcert.org.tw/tw/cp-132-4273-24e01-1.html
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-18478		Advisory
https://www.twcert.org.tw/tw/cp-132-4273-24e01-1.html		x_refsource_MISCThird Party Advisory