CVE-2014-1861
Loading...
General | |
|---|---|
| Score: | 9.3/10.0 |
| Severity: | High |
| Category: | Input Validation Error |
Impact Metrics | |
| Confidentiality: | Complete |
| Integrity: | Complete |
| Availability: | Complete |
Exploitability Metrics | |
| Access Vector: | Network |
| Access Complexity: | Medium |
| Authentication: | None |
Published on 18/02/14 - Updated on 21/02/14
Description
The client in Jetro COCKPIT Secure Browsing (JCSB) 4.3.1 and 4.3.3 does not validate the FileName element in an RDP_FILE_TRANSFER document, which allows remote JCSB servers to execute arbitrary programs by providing a .EXE extension.
Category: Input Validation Error
CWE-20 (Input Validation)
The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.
Security Notices
 | CVE-2014-1861 |
Exploits
No exploits available for this CVE in our database.