title: tobesoft Nexacro platform arbitrary file creation vulnerability
description: An improper input validation leading to arbitrary file creation was discovered in copy method of Nexacro platform. Remote attackers use copy method to execute arbitrary command after the file creation included malicious code.
problem types: CWE-20 Improper Input Validation
affected:
{
platforms: Windows
product: NEXACRO17
vendor: TOBESOFT
versions:
lessThanOrEqual: 17.1.2.500, status: affected, version: 17.1.2.500, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
version: 3.1
]