High severity · published Mar 29, 2017
CVE-2017-7310
A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6, DiskSorter before 10.6, DiskBoss before 8.9, DiskPulse before 10.6, DiskSavvy before 10.6, DupScout…
7.8
CVSS
53.7%
EPSS
No
On KEV
Description
A buffer overflow vulnerability in Import Command in SyncBreeze before 10.6, DiskSorter before 10.6, DiskBoss before 8.9, DiskPulse before 10.6, DiskSavvy before 10.6, DupScout before 10.6, and VX Search before 10.6 allows attackers to execute arbitrary code via a crafted XML file containing a long name attribute of a classify element.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)53.7% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DI
Diskboss · Flexense
7.8.16 · source: NVD
DI
Disksorter · Flexense
9.5.12 · source: NVD
SY
Syncbreeze · Flexense
9.5.16 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-7310
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-7310
www.diskboss.com
http://www.diskboss.com/news.html
www.diskpulse.com
http://www.diskpulse.com/news.html
www.disksavvy.com
http://www.disksavvy.com/news.html
www.disksorter.com
http://www.disksorter.com/news.html
www.dupscout.com
http://www.dupscout.com/news.html
Third Party Advisory
http://www.securityfocus.com/bid/97237
More from Diskboss
9.8
CVE-2018-5262
A stack-based buffer overflow in Flexense DiskBoss 8.8.16 and earlier allows unauthenticated remote attackers to execute arbitrary code in the context of a highly privileged…
8.1
CVE-2018-5261
An issue was discovered in Flexense DiskBoss 8.8.16 and earlier
7.8
CVE-2020-36881
Flexsense DiskBoss 'Add Input Directory' Buffer Overflow
7.8
CVE-2020-36880
Flexsense DiskBoss 'Reports and Data Directory' Buffer Overflow
7.5
CVE-2020-36882
Flexsense DiskBoss Application Crash Denial of Service