NVD

Id
30411  
Name
CVE-2014-1861  
Description
The client in Jetro COCKPIT Secure Browsing (JCSB) 4.3.1 and 4.3.3 does not validate the FileName element in an RDP_FILE_TRANSFER document, which allows remote JCSB servers to execute arbitrary programs by providing a .EXE extension.  
Reject
 
CVSS Version
2  
CVSS Score
9.3  
Severity
High  
CVSS Base Score
9.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2014-02-18  
Modified Date
2014-02-20  
Seq
2014-1861  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
160888 30411 CVE-2014-1861 20140217 Jetro Cockpit Secure Browsing vulnerability - Client missing input validation allowing RCE  View
160889 30411 CVE-2014-1861 http://blog.quaji.com/2014/02/remote-code-execution-on-all-enterprise.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
12552 JVNDB-2014-001427 Jetro COCKPIT4i Secure Browsing のクライアントにおける任意のプログラムを実行される脆弱性 Jetro COCKPIT4i Secure Browsing (JCSB) のクライアントは、RDP_FILE_TRANSFER ドキュメント内の FileName 要素を検証しないため、任意のプログラムを実行される脆弱性が存在します。 CVE-2014-1861 69148 CVE-2014-1861 30411 9.3 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-001427.html 2014-02-02 2014-02-24 View