« Volver al listado

CVE-2014-8394

Estado: ModificadaMedia (4.6)—

Múltiples vulnerabilidades de ruta de búsqueda no confiable en Corel CAD 2014 permiten a usuarios locales ejecutar código arbitrario y realizar ataques del secuestro de DLL a través de un fichero (1) FxManagedCommands_3.08_9.tx o (2) TD_Mgd_3.08_9.dll troyano en el directorio de trabajos actuales.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Corel — Corelcad

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-8394",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-01-15T15:59:09.637",
  "references": [
    {
      "url": "http://seclists.org/fulldisclosure/2015/Jan/33",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.coresecurity.com/advisories/corel-software-dll-hijacking",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/534452/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/72004",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2015/Jan/33",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.coresecurity.com/advisories/corel-software-dll-hijacking",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/534452/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/72004",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple untrusted search path vulnerabilities in Corel CAD 2014 allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) FxManagedCommands_3.08_9.tx or (2) TD_Mgd_3.08_9.dll file in the current working directory."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de ruta de búsqueda no confiable en Corel CAD 2014 permiten a usuarios locales ejecutar código arbitrario y realizar ataques del secuestro de DLL a través de un fichero (1) FxManagedCommands_3.08_9.tx o (2) TD_Mgd_3.08_9.dll troyano en el directorio de trabajos actuales."
    }
  ],
  "lastModified": "2026-06-17T00:16:40.680",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:corel:corelcad:2014:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D00170EC-8F98-49DD-8DA2-0BB13AEE131E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/426.html\">CWE-426: Untrusted Search Path</a>",
  "sourceIdentifier": "cve@mitre.org"
}