CVE-2024-7262Arbitrary Code Execution in WPS Office
Aktif olarak istismar ediliyor — Kingsoft WPS Office Path Traversal Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 03.09.2024 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 24.09.2024.
Gerekli işlem: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. While CISA cannot confirm the effectiveness of patches at this time, it is recommended that mitigations be applied per vendor instructions if available. If these instructions cannot be located or if mitigations are unavailable, discontinue the use of the product.; https://nvd.nist.gov/vuln/detail/CVE-2024-7262
Açıklama
Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| Kingsoft | WPS Office | 12.2.0.13110 – < 12.2.0.16412 |
Kaynaklar ve yamalar
- https://www.wps.com/whatsnew/pc/20240422/ Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7262 US Government Resource
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:kingsoft:wps_office:*:*:*:*:*:*:*:*≥ 12.2.0.13110 < 12.2.0.16412