Improper input validation in Raonwiz Raon K Upload
CVE-2020-7863
A vulnerability in File Transfer Solution of Raonwiz could allow arbitrary command execution as the result of viewing a specially-crafted web page. This vulnerability is due to insufficient validation of the parameter of the specific method. An attacker could exploit this vulnerability by setting the parameter to the command they want to execute. A successful exploit could allow the attacker to execute arbitrary commands on a target system as the user. However, the victim must run the Internet Explorer browser with administrator privileges because of the cross-domain policy.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.015 (72.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Raonwiz Raon_k_upload
- Raonwiz,inc Raon K Upload — versions 2018.0.2.55
Weakness classification (CWE)
References
- vuln@krcert.or.kr (Third Party Advisory, x_refsource_MISC)
- vuln@krcert.or.kr (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-7863?
- CVE-2020-7863 is a high-severity vulnerability in Raonwiz Raon K Upload, classified under Improper Input Validation. CVSS score: 8.8/10. Published 2021-08-05.
- How severe is CVE-2020-7863?
- High severity. CVSS v3 base score is 8.8 out of 10.