title: HANDY Groupware file download and execute vulnerability
description: Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbitrary files. This vulnerability can be exploited by using the file download or execution path as the parameter value of the vulnerable function.
problem types: CWE-20 Improper Input Validation
affected:
{
platforms: Windows
product: HANDY Groupware
vendor: Handysoft Co.,Ltd
versions:
lessThanOrEqual: 1.7.4.6, status: affected, version: unspecified, versionType: custom
}
{
platforms: Windows
product: HANDY Groupware
vendor: Handysoft Co.,Ltd
versions:
lessThanOrEqual: 2.0.3.6, status: affected, version: unspecified, versionType: custom
}
{
platforms: Windows
product: HANDY Groupware
vendor: Handysoft Co.,Ltd
versions:
lessThanOrEqual: 4.0.1.7, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]