vulnwire
6.5med

CVE-2016-7845

GigaCC OFFICE ver.2.3 and earlier allows remote attackers to upload arbitrary files as a user profile image, which may be exploited for una…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
6.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.4%
percentile 73%
Public exploits
0
none known

GigaCC OFFICE ver.2.3 and earlier allows remote attackers to upload arbitrary files as a user profile image, which may be exploited for unauthorized file sharing.

Exploit prediction (EPSS)

1.43% probability of exploitation in the next 30 days, higher than 73% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.06.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
NVD2.05.5AV:N/AC:L/Au:S/C:P/I:N/A:P

Affected products

  • WAM!NET Japan K.K. GigaCC OFFICE

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls

References

  • asp.gigacc.com /user/publicurl/view.do%3Bjsessionid=28438FE401A764B7CEDB3664AB2AC67C.ap04?job=view&direct · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/95680 · vdb-entry, x_refsource_BID, x_transferred
  • jvn.jp /en/vu/JVNVU91417143/index.html · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.