Vulnerability Description
The WPS Office (aka cn.wps.moffice_eng) application before 17.0.0 for Android fails to properly sanitize file names before processing them through external application interactions, leading to a form of path traversal. This potentially enables any application to dispatch a crafted library file, aiming to overwrite an existing native library utilized by WPS Office. Successful exploitation could result in the execution of arbitrary commands under the guise of WPS Office's application ID.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://www.microsoft.com/en-us/security/blog/2024/05/01/dirty-stream-attack-dis
- https://www.microsoft.com/en-us/security/blog/2024/05/01/dirty-stream-attack-dis
FAQ
What is CVE-2024-35205?
CVE-2024-35205 is a vulnerability with a CVSS score of 7.8 (HIGH). The WPS Office (aka cn.wps.moffice_eng) application before 17.0.0 for Android fails to properly sanitize file names before processing them through external application interactions, leading to a form ...
How severe is CVE-2024-35205?
CVE-2024-35205 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-35205?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.