Vulnerability Description
The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into the window source to create a button that spawns a command shell.
CVSS Score
7.8
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Epicor | Crs Retail Store | <= 3.2.03.01.008 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/131732/Epicor-Retail-Store-Help-System-3.2.MitigationThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/archive/1/535423/100/1000/threaded
- http://packetstormsecurity.com/files/131732/Epicor-Retail-Store-Help-System-3.2.MitigationThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/archive/1/535423/100/1000/threaded
FAQ
What is CVE-2015-2210?
CVE-2015-2210 is a vulnerability with a CVSS score of 7.8 (HIGH). The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into the window source to create a button that spawns a command she...
How severe is CVE-2015-2210?
CVE-2015-2210 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-2210?
Check the references section above for vendor advisories and patch information. Affected products include: Epicor Crs Retail Store.