Group-Office Vulnerable to Remote Code Execution (RCE)
概要
Group-Office Vulnerable to Remote Code Execution (RCE)
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.9, 25.0.87, and 6.8.154 have an authenticated Remote Code Execution vulnerability in the TNEF attachment processing flow. The vulnerable path extracts attacker-controlled files from winmail.dat and then invokes zip with a shell wildcard (*). Because extracted filenames are attacker-controlled, they can be interpreted as zip options and lead to arbitrary command execution. Versions 26.0.9, 25.0.87, and 6.8.154 fix the issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov