Vulnerability · Published Jun 3, 2022 · Assigned by mitre

CVE-2022-32271

Critical 9.6

In plain English

A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 88% of all known vulnerabilities).

Severity (CVSS NVD)9.6Critical

Exploit odds (30 days)3.0%top 12.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In Real Player 20.0.8.310, there is a DCP:// URI Remote Arbitrary Code Execution Vulnerability. This is an internal URL Protocol used by Real Player to reference a file that contains an URL. It is possible to inject script code to arbitrary domains. It is also possible to reference arbitrary local files.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://youtu.be/AMODp3iTnqY x_refsource_MISC
https://github.com/Edubr2020/RP_DCP_Code_Exec x_refsource_MISC