Directory Traversal Vulnerability in JetAudio by Jetaudio
CVE-2007-4983

Currently unrated

Key Information:

Vendor

Cowon America

Status
Jetaudio
Vendor
CVE Published:
19 September 2007

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 47%

What is CVE-2007-4983?

A directory traversal vulnerability exists in the JetAudio.Interface.1 ActiveX control within the JetFlExt.dll component of jetAudio versions 7.0.3 Basic and 7.0.3.3016. This flaw enables remote attackers to manipulate local files by using relative path specifications, such as ..\ (dot dot backslash), in the second argument of the DownloadFromMusicStore method. Successful exploitation can lead to the overwriting of critical local files, including JetAudio.exe, facilitating potential execution of arbitrary code due to the execution flow introduced post-method call. It is crucial for users to ensure they have the latest security updates to mitigate this risk.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2007-4983 - Proof of Concept

References

http://www.vupen.com/english/advisories/2007/3196
vdb-entryx_refsource_VUPEN
http://www.securitytracker.com/id?1018716
vdb-entryx_refsource_SECTRACK
https://exchange.xforce.ibmcloud.com/vulnerabilities/36693
vdb-entryx_refsource_XF

EPSS Score

47% chance of being exploited in the next 30 days.

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.