CVE-2020-7882 - anySign directory traversal vulnerability

Back Back to CVE browser

CRITICAL

anySign directory traversal vulnerability

Published Nov 22, 2021

9.1

CRITICAL

CVSS 3.1

EPSS 1.30%

Description

Using the parameter of getPFXFolderList function, attackers can see the information of authorization certification and delete the files. It occurs because the parameter contains path traversal characters(ie. '../../../')

Affected products

Vendor Hancomwith Product anySign4PC Default
n/a
- Version
  1.1.1.0
  Status
  affected
  Constraints
  -
- Version
  1.1.2.6
  Status
  affected
  Constraints
  -
- Version
  1.1.2.7
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Hancomwith

anySign4PC

n/a

Version	Status	Constraints
1.1.1.0	affected	-
1.1.2.6	affected	-
1.1.2.7	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-22

Path Traversal

CWE-24

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28814
Advisory
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36344
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28814		Advisory
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36344		x_refsource_MISCThird Party Advisory