Vulnerability · Published May 21, 2020 · Assigned by krcert
CVE-2020-7808RAONWIZ Inc K Upload, arguments modiffication via missing support for integrity check vulnerability
High 8.7
In plain English
A high-severity argument injection in K Upload from RAONWIZ Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 3.1)8.7High
Exploit odds (30 days)0.7%top 47.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In RAONWIZ K Upload v2018.0.2.51 and prior, automatic update processing without integrity check on update module(web.js) allows an attacker to modify arguments which causes downloading a random DLL and injection on it.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| RAONWIZ Inc | K Upload | unspecified – through 2018.0.2.51 |
Weakness: CWE-353, CWE-88 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:H
References
- https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35424 x_refsource_CONFIRM