CVE-2020-24742

CVE-2020-24742

High · published August 10, 2021

CVSS v3.1
7.8
EPSS
1%
Percentile
67.1
In the wild
Unconfirmed
What it is

An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute arbitrary code via crafted files.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01167 · 67.1th percentile
Published
2021-08-10T02:15Z
Affected products (2)
ProductVersionsFixed in
qt/qt≥ 5.6.0, < 5.12.75.12.7
qt/qt≥ 5.13.0, ≤ 5.13.2—
References (2)
https://codereview.qt-project.org/c/qt/qtbase/+/280730 · [email protected]https://codereview.qt-project.org/c/qt/qtbase/+/280730 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 09 AUG 21:18Z
    An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attackers to execute…
    cvelistv5