CVE-2024-3459CWE-424

KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by default are opened in an external PDF…

High · published May 9, 2024

CVSS v3.1
8.4
EPSS
0%
Percentile
17.9
In the wild
Unconfirmed
What it is

KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by default are opened in an external PDF viewer. By using built-in functions of that viewer it is possible to launch a web browser, search through local files and, subsequently, launch any program with user privileges.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00268 · 17.9th percentile
Weakness
CWE-424 · Improper Protection of Alternate Path
Published
2024-05-09T10:13Z
EPSS history
Timeline
  • 09 MAY 10:13Z
    KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by default are opened in an external PDF…
    cvelistv5