CVE-2021-37444

NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive

published July 25, 2021

CVSS
—
EPSS
2%
Percentile
79.9
In the wild
Unconfirmed
What it is

NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive. This can lead to code execution if a ZIP element's pathname is set to a Windows startup folder, a file for the inbuilt Out-Going Message function, or a file for the the inbuilt Autodial function.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01935 · 79.9th percentile
Published
2021-07-25T20:13Z
EPSS history
Timeline
  • 25 JUL 20:13Z
    NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive
    cvelistv5