Vulnerability · Published Nov 25, 2022 · Assigned by krcert
CVE-2022-41158eyoom builder Remote Code Execution Vulnerability
High 7.2
In plain English
A high-severity path traversal in eyoom builder from eyoom Co.,Ltd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)2.1%top 18.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Remote code execution vulnerability can be achieved by using cookie values as paths to a file by this builder program. A remote attacker could exploit the vulnerability to execute or inject malicious code.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| eyoom Co.,Ltd | eyoom builder | unspecified – through 4.5.3 |
Weakness: CWE-22, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H