« Volver al listado

CVE-2010-5257

Estado: ModificadaMedia (6.9)—

Multiple untrusted search path vulnerabilities in ArchiCAD 13 and 14 allow local users to gain privileges via a Trojan horse (1) srcsrv.dll or (2) GSAutoTester.DLL file in the current working directory, as demonstrated by a directory that contains a .2df file. NOTE: some of these details are obtained from third party information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Graphisoft — Archicad

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2010-5257",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.9,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-09-07T10:32:22.663",
  "references": [
    {
      "url": "http://secunia.com/advisories/41231",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.corelan.be:8800/index.php/2010/08/25/dll-hijacking-kb-2269637-the-unofficial-list/",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/41231",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.corelan.be:8800/index.php/2010/08/25/dll-hijacking-kb-2269637-the-unofficial-list/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple untrusted search path vulnerabilities in ArchiCAD 13 and 14 allow local users to gain privileges via a Trojan horse (1) srcsrv.dll or (2) GSAutoTester.DLL file in the current working directory, as demonstrated by a directory that contains a .2df file.  NOTE: some of these details are obtained from third party information."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de path de búsqueda no confiable en ArchiCAD 13 y 14, permite a usuario locales obtener privilegios a través de los ficheros (1) srcsrv.dll o (2) GSAutoTester.DLL troyanizados en el directorio de trabajo actual, como se demostró mediante un directorio que contenía fichero .2df. NOTA: Algunos de estos detalles se han obtenido de información de terceros."
    }
  ],
  "lastModified": "2026-06-16T23:26:25.843",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:graphisoft:archicad:13.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "343FC07C-F49C-48D0-B210-7560B8619B98"
            },
            {
              "criteria": "cpe:2.3:a:graphisoft:archicad:14.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A67BFCF2-7AA6-4257-92C4-31CBCA8BB0D8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "Per: http://cwe.mitre.org/data/definitions/426.html 'CWE-426 Untrusted Search Path'",
  "sourceIdentifier": "cve@mitre.org"
}