title: RAONWIZ Inc K Upload, arguments modiffication via missing support for integrity check vulnerability
description: In RAONWIZ K Upload v2018.0.2.51 and prior, automatic update processing without integrity check on update module(web.js) allows an attacker to modify arguments which causes downloading a random DLL and injection on it.
problem types: CWE-353 Missing Support for Integrity Check
affected:
{
platforms: windows 7/8/10
product: K Upload
vendor: RAONWIZ Inc
versions:
lessThanOrEqual: 2018.0.2.51, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:H
version: 3.1
]