CVE-2008-7168
Insecure method vulnerability in the UUSee UUUpgrade ActiveX control (UUUpgrade.ocx 3.0.2.12) allows remote attackers to force the download and overwrite of arbitrary files via crafted arguments to the Update method, as exploited in the wild in June 2009.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.65%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Insecure method vulnerability in the UUSee UUUpgrade ActiveX control (UUUpgrade.ocx 3.0.2.12) allows remote attackers to force the download and overwrite of arbitrary files via crafted arguments to the Update method, as exploited in the wild in June 2009.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 5.65% probability · 93th percentile
- CISA KEV
- Not listed
- Affected
- uusee/uusee · uusee/uuupgrade.ocx
- Source
- cve@mitre.org
References
- http://downloads.securityfocus.com/vulnerabilities/exploits/29963.htmlExploit
- http://www.securityfocus.com/bid/29963Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43428
- http://downloads.securityfocus.com/vulnerabilities/exploits/29963.htmlExploit
- http://www.securityfocus.com/bid/29963Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43428
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.