CVE-2023-1745
KMPlayer SHFOLDER.dll uncontrolled search path
- State
- Published
- Severity
- 5.3 Medium
- Published
- Mar 30, 2023
- Updated
- Aug 2, 2024
- Reserved
- Mar 30, 2023
Description
A vulnerability, which was classified as problematic, has been found in KMPlayer 4.2.2.73. This issue affects some unknown processing in the library SHFOLDER.dll. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-224633 was assigned to this vulnerability.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 3.0 | 5.3 Medium | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 2.0 | 4.3 Medium | AV:L/AC:L/Au:S/C:P/I:P/A:P | VulDB |
Weaknesses
- CWE-427 Uncontrolled Search Path
Affected Products
| Product | Versions |
|---|---|
KMPlayern/a |
|
References
- https://vuldb.com/?id.224633vdb-entrytechnical-description
- https://vuldb.com/?ctiid.224633signaturepermissions-required
- https://github.com/10cksYiqiyinHangzhouTechnology/KMPlayer_Pocexploit
- https://drive.google.com/file/d/1bdYaDmtWhnjaHkzv3bZ4PUSMzDJ8JjSV/viewexploit
- https://youtu.be/7bh2BQOqxFomedia-coverage
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.