Veille CVE
CVE-2021-27852
9.8 Critique Exploitée activementCatalogue CISA KEV — Checkbox Survey Deserialization of Untrusted Data Vulnerability
Ajoutée le 11/04/2022 · Échéance de correction (agences US) : 02/05/2022
Action requise : Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.
Description
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 9.8 Critique | cret@cert.org | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 9.8 Critique | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | 7.5 Élevée | nvd@nist.gov (NVD) | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Faiblesses (CWE)
Références
- https://www.kb.cert.org/vuls/id/706695 Third Party AdvisoryUS Government Resource
- https://www.kb.cert.org/vuls/id/706695 Third Party AdvisoryUS Government Resource
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27852 US Government Resource