CVE-2008-3957
The Microsoft Windows Image Acquisition Logger ActiveX control allows remote attackers to force the download of arbitrary files onto a client system via a URL in the first argument to the Open method, in conjunction with a full destination pathname in…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 17.8%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
The Microsoft Windows Image Acquisition Logger ActiveX control allows remote attackers to force the download of arbitrary files onto a client system via a URL in the first argument to the Open method, in conjunction with a full destination pathname in the first argument to the Save method. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 17.76% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- microsoft/windows image acquisition logger
- Source
- cve@mitre.org
References
- http://www.securityfocus.com/bid/31069Exploit
- http://www.securityfocus.com/data/vulnerabilities/exploits/31069
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45015
- http://www.securityfocus.com/bid/31069Exploit
- http://www.securityfocus.com/data/vulnerabilities/exploits/31069
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45015
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.