Vulnerability in Jscom Revoworks Browser
CVE-2022-27176
Incomplete filtering of special elements vulnerability exists in RevoWorks SCVX using 'File Sanitization Library' 1.043 and prior versions, RevoWorks Browser 2.2.67 and prior versions (when using 'File Sanitization Option'), and RevoWorks Desktop 2.1.84 and prior versions (when using 'File Sanitization Option'), which may allow an attacker to execute a malicious macro by having a user to download, import, and open a specially crafted file in the local environment.
EPSS: 0.006 (44.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Jscom Revoworks_browser
- Jscom Revoworks_desktop
- Jscom Revoworks_scvx
- J’s Communication Co., Ltd. Revoworks Scvx, Browser, And — versions RevoWorks SCVX using 'File Sanitization Library' 1.043 and prior versions, RevoWorks Browser 2.2.67 and prior versions (when using 'File Sanitization Option'), and RevoWorks Desktop 2.1.84 and prior versions (when using 'File Sanitization Option')
References
- vultures@jpcert.or.jp (x_refsource_MISC, Vendor Advisory)
- vultures@jpcert.or.jp (Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2022-27176?
- CVE-2022-27176 is a high-severity vulnerability in Jscom Revoworks Browser. CVSS score: 7.8/10. Published 2022-06-14.
- How severe is CVE-2022-27176?
- High severity. CVSS v3 base score is 7.8 out of 10.