Incomplete Filtering Vulnerability in RevoWorks Products
CVE-2022-27176

7.8HIGH

Key Information:

Vendor

J’s Communication Co., Ltd.

Status
Revoworks Scvx, Revoworks Browser, And Revoworks
Vendor
CVE Published:
14 June 2022

What is CVE-2022-27176?

A vulnerability exists in RevoWorks SCVX that arises from inadequate filtering of specially crafted file elements. This flaw affects the File Sanitization Library in versions 1.043 and earlier, along with RevoWorks Browser 2.2.67 and Desktop 2.1.84 versions prior to the implementation of the File Sanitization Option. If exploited, this vulnerability could allow attackers to execute malicious macros by enticing users to download, import, and open compromised files within their local environments.

Affected Version(s)

RevoWorks SCVX, RevoWorks Browser, and RevoWorks RevoWorks SCVX using 'File Sanitization Library' 1.043 and prior versions, RevoWorks Browser 2.2.67 and prior versions (when using 'File Sanitization Option'), and RevoWorks Desktop 2.1.84 and prior versions (when using 'File Sanitization Option')

References

https://jscom.jp/news-20220527/
x_refsource_MISC
https://jvn.jp/en/jp/JVN27256219/index.html
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.