CVE-2021-26630CWE-20

HANDY Groupware file download and execute vulnerability

High · published May 19, 2022

CVSS v3.1
7.8
EPSS
1%
Percentile
56.5
In the wild
Unconfirmed
What it is

Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbitrary files. This vulnerability can be exploited by using the file download or execution path as the parameter value of the vulnerable function.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00813 · 56.5th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2022-05-19T14:52Z
EPSS history
Timeline
  • 19 MAY 14:52Z
    HANDY Groupware file download and execute vulnerability
    cvelistv5