Vulnerability · Published Oct 27, 2021 · Assigned by krcert
CVE-2020-7867Helpu arbitrary file creation vulnerability
High 8.0
In plain English
A high-severity improper input validation in HelpuViewer.exe from HelpU. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Severity (CVSS 3.1)8.0High
Exploit odds (30 days)0.8%top 42.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An improper input validation vulnerability in Helpu solution could allow a local attacker to arbitrary file creation and execution without click file transfer menu. It is possible to file in arbitrary directory for user because the viewer program receive the file from agent with privilege of administrator.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HelpU | HelpuViewer.exe | 2018.5.21.0 – through 2018.5.21.0 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H