CVE-2020-7846 - Helpcom before v10.0 contains a file download and execution vulnerability caused by storing hardcoded cryptographic key

Back Back to CVE browser

HIGH

Helpcom before v10.0 contains a file download and execution vulnerability caused by storing hardcoded cryptographic key

Published Feb 24, 2021

8.8

HIGH

CVSS 3.1

EPSS 1.06%

Description

Helpcom before v10.0 contains a file download and execution vulnerability caused by storing hardcoded cryptographic key. It finally leads to a file download and execution via access to crafted web page.

Affected products

Vendor Cnesty Product Helpcom Default
n/a
- Version
  < 10.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cnesty

Helpcom

n/a

Version	Status	Constraints
< 10.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-321

CWE-798

Hard-coded Credentials

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28778
Advisory
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35919
x_refsource_CONFIRMThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28778		Advisory
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35919		x_refsource_CONFIRMThird Party Advisory