VulnerabilityDeferred

CVE-2024-46939

The game extension engine of versions 1.2.7.0 and earlier exposes some components, and attackers can construct parameters to perform path traversal attacks, which can overwrite local specific files

LOW 2.4EPSS 0.20%

Does this matter?

Lower severity and a low EPSS score (0.20%). Track it; it rarely justifies an emergency change on its own.

Description

The game extension engine of versions 1.2.7.0 and earlier exposes some components, and attackers can construct parameters to perform path traversal attacks, which can overwrite local specific files

CVSS 4.0: 2.4 LOWCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.20% probability · 10th percentile
CISA KEV: Not listed
Weakness: CWE-22
Source: security@vivo.com

References

https://www.vivo.com/en/support/security-advisory-detail?id=13

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.