CVE-2021-33592

{"id": "CVE-2021-33592", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-07-19T06:15:06.903", "references": [{"url": "https://cve.naver.com/detail/cve-2021-33592", "tags": ["Vendor Advisory"], "source": "cve@navercorp.com"}, {"url": "https://cve.naver.com/detail/cve-2021-33592", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve@navercorp.com", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "NAVER Toolbar before 4.0.30.323 allows remote attackers to execute arbitrary code via a crafted upgrade.xml file. Special characters in filename parameter can be the cause of bypassing code signing check function."}, {"lang": "es", "value": "NAVER Toolbar versiones anteriores a 4.0.30.323, permite a atacantes remotos ejecutar c\u00f3digo arbitrario por medio de un archivo upgrade.xml dise\u00f1ado. Los caracteres especiales en el par\u00e1metro filename pueden ser la causa de la omisi\u00f3n de la funci\u00f3n de comprobaci\u00f3n de la firma del c\u00f3digo"}], "lastModified": "2024-11-21T06:09:09.590", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:naver:toolbar:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "010608DB-28F5-4CE9-9494-B3D2196ABA16", "versionEndExcluding": "4.0.30.323"}], "operator": "OR"}]}], "sourceIdentifier": "cve@navercorp.com"}