CVE-2009-0134
Insecure method vulnerability in the EasyGrid.SGCtrl.32 ActiveX control in EasyGrid.ocx 1.0.0.1 in AAA EasyGrid ActiveX 3.51 allows remote attackers to create and overwrite arbitrary files via the (1) DoSaveFile or (2) DoSaveHtmlFile method.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (8.86%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Insecure method vulnerability in the EasyGrid.SGCtrl.32 ActiveX control in EasyGrid.ocx 1.0.0.1 in AAA EasyGrid ActiveX 3.51 allows remote attackers to create and overwrite arbitrary files via the (1) DoSaveFile or (2) DoSaveHtmlFile method. NOTE: vector 1 could be leveraged for code execution by creating executable files in Startup folders or by accessing files using hcp:// URLs. NOTE: some of these details are obtained from third party information.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 8.86% probability · 95th percentile
- CISA KEV
- Not listed
- Affected
- share2/easy grid control
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/33537Vendor Advisory
- http://securityreason.com/securityalert/4913
- http://www.securityfocus.com/bid/33272Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47946
- https://www.exploit-db.com/exploits/7779
- http://secunia.com/advisories/33537Vendor Advisory
- http://securityreason.com/securityalert/4913
- http://www.securityfocus.com/bid/33272Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47946
- https://www.exploit-db.com/exploits/7779
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.