« Volver al listado

CVE-2017-2252

Estado: ModificadaAlta (7.8)—

Untrusted search path vulnerability in self-extracting archive files created by File Compact Ver.5 version 5.10 and earlier, Ver.6 version 6.02 and earlier, Ver.7 version 7.02 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Sourcenext — File Compact

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-2252",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "SOURCENEXT CORPORATION",
          "product": "Self-extracting archive files created by File Compact",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.5 version 5.10 and earlier"
            },
            {
              "status": "affected",
              "version": "Ver.6 version 6.02 and earlier"
            },
            {
              "status": "affected",
              "version": "Ver.7 version 7.02 and earlier"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-07-17T13:18:23.297",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN29939155/index.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN29939155/index.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-426"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Untrusted search path vulnerability in self-extracting archive files created by File Compact Ver.5 version 5.10 and earlier, Ver.6 version 6.02 and earlier, Ver.7 version 7.02 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de ruta (path) de búsqueda no confiable en archivos Autoextraíbles creados por File Compact Ver.5 versión 5.10 y anteriores, Ver.6 versión 6.02 y anterior, Ver.7 versión 7.02 y anterior, permite a un atacante alcanzar privilegios por medio de una DLL de tipo caballo de Troya en un directorio no especificado."
    }
  ],
  "lastModified": "2026-06-17T01:15:49.730",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sourcenext:file_compact:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "226F3AEC-A582-45D8-9BBC-10AA505443F7",
              "versionEndIncluding": "5.09"
            },
            {
              "criteria": "cpe:2.3:a:sourcenext:file_compact:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7424DCC6-79F4-4F9B-966E-D9E03C86D5B1",
              "versionEndIncluding": "6.01"
            },
            {
              "criteria": "cpe:2.3:a:sourcenext:file_compact:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22636993-DD45-47C4-954E-1CB35795255D",
              "versionEndIncluding": "7.01"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}