CVE-2024-10068

OpenSight Software FlashFXP FlashFXP.exe uncontrolled search path

View on CVE.org
Published Oct 17, 2024 CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Description
A vulnerability was found in OpenSight Software FlashFXP 5.4.0.3970. It has been classified as critical. Affected is an unknown function in the library libcrypto-1_1.dll of the file FlashFXP.exe. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2024-32889 A vulnerability was found in OpenSight Software FlashFXP 5.4.0.3970. It has been classified as critical. Affected is an unknown function in the library libcrypto-1_1.dll of the file FlashFXP.exe. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00027}

 epss

{'score': 0.0003}
Type Values Removed Values Added
First Time appeared Flashfxp
Flashfxp flashfxp
CPEs cpe:2.3:a:flashfxp:flashfxp:1.4:*:*:*:*:*:*:*
Vendors & Products Flashfxp
Flashfxp flashfxp
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was found in OpenSight Software FlashFXP 5.4.0.3970. It has been classified as critical. Affected is an unknown function in the library libcrypto-1_1.dll of the file FlashFXP.exe. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title OpenSight Software FlashFXP FlashFXP.exe uncontrolled search path
Weaknesses CWE-427
References
Metrics cvssV2_0

{'score': 6.8, 'vector': 'AV:L/AC:L/Au:S/C:C/I:C/A:C'}

cvssV3_0

{'score': 7.8, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 17, 2024, 5:56 PM
Reserved
Oct 17, 2024, 6:12 AM

View source JSON

Updated
Oct 17, 2024, 5:56 PM

JSON

Status
Deferred
Published
Oct 17, 2024, 11:15 AM
Modified
Jun 17, 2026, 6:54 AM

View source JSON

No data.

No data.