DLL Hijacking in InternetSoft FTP Commander Affected by Untrusted Search Path
CVE-2017-11749

7.8HIGH

Key Information:

Vendor

Internet-soft

Status
Ftp Commander
Vendor
CVE Published:
3 October 2022

What is CVE-2017-11749?

InternetSoft FTP Commander versions 8.02 and earlier exhibit a vulnerability due to an untrusted search path, which can be exploited for DLL hijacking. This allows an attacker to place a malicious dwmapi.dll file in a location that the application will load, leading to unauthorized code execution. Users of affected versions should ensure they update to the latest version to mitigate this risk.

References

http://blog.pentest.space/2017/07/023-ftp-commander-802-u...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.