CVE-2021-26630
HANDY Groupware file download and execute vulnerability
- State
- Published
- Severity
- 7.8 High
- Published
- May 19, 2022
- Updated
- Aug 3, 2024
- Reserved
- Feb 3, 2021
Description
Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbitrary files. This vulnerability can be exploited by using the file download or execution path as the parameter value of the vulnerable function.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.8 High | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | krcert |
Weaknesses
- CWE-20 Improper Input Validation
Affected Products
| Product | Versions |
|---|---|
HANDY GroupwareHandysoft Co.,Ltd |
|
HANDY GroupwareHandysoft Co.,Ltd |
|
HANDY GroupwareHandysoft Co.,Ltd |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.