CVE-2013-6128 — MEDIUM (5.8)

Q: How severe is CVE-2013-6128?

CVE-2013-6128 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2013-6128?

Check the references section above for vendor advisories and patch information. Affected products include: Wellintech Kingview.

Vulnerability Description

The KCHARTXYLib.KChartXY ActiveX control in KChartXY.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 does not properly restrict SaveToFile method calls, which allows remote attackers to create or overwrite arbitrary files, and subsequently execute arbitrary programs, via the single pathname argument, as demonstrated by a directory traversal attack.

CVSS Score

5.8

MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:P

Confidentiality

NONE

Integrity

PARTIAL

Availability

PARTIAL

Affected Products

Vendor	Product	Versions
Wellintech	Kingview	<= 6.52

Related Weaknesses (CWE)

CWE-264

References

http://ics-cert.us-cert.gov/advisories/ICSA-13-295-01PatchUS Government Resource
http://www.exploit-db.com/exploits/28085/
http://ics-cert.us-cert.gov/advisories/ICSA-13-295-01PatchUS Government Resource
http://www.exploit-db.com/exploits/28085/

FAQ

What is CVE-2013-6128?

CVE-2013-6128 is a vulnerability with a CVSS score of 5.8 (MEDIUM). The KCHARTXYLib.KChartXY ActiveX control in KChartXY.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 does not properly restrict SaveToFile method calls, which allows remote attackers t...

How severe is CVE-2013-6128?

CVE-2013-6128 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2013-6128?

Check the references section above for vendor advisories and patch information. Affected products include: Wellintech Kingview.