Untrusted Search Path Vulnerability in Shinseiyo Sogo Soft Installer
CVE-2017-2232

7.8HIGH

Key Information:

Vendor

The Ministry Of Justice

Status
Installer Of Shinseiyo Sogo Soft
Vendor
CVE Published:
7 July 2017

What is CVE-2017-2232?

The Shinseiyo Sogo Soft Installer has a vulnerability that allows an attacker to exploit an untrusted search path. Specifically, this weakness enables malicious users to execute a Trojan horse DLL placed in a directory that the installer accesses, potentially leading to privilege escalation. Users of Shinseiyo Sogo Soft versions up to 4.8A should be aware of this risk and take appropriate measures to secure their systems.

Affected Version(s)

Installer of Shinseiyo Sogo Soft (4.8A) and earlier

References

http://jvn.jp/en/jp/JVN23389212/index.html
third-party-advisoryx_refsource_JVN

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.