CVE-2020-7804 Command injection in HandySoft Groupware(HShell.dll) for for Windows 7, 8, 10
Attackers can execute arbitrary commands via the ShellExec method in the Handy Groupware ActiveX control, potentially compromising the host system.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-7804?
CVE-2020-7804 is a medium-severity command injection vulnerability in HandySoft Groupware(HShell.dll) for for Windows 7, 8, 10, published on 29 Apr 2020. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
ActiveX Control(HShell.dll) in Handy Groupware 1.7.3.1 for Windows 7, 8, and 10 allows an attacker to execute arbitrary command via the ShellExec method.
Weakness: CWE-78
Which versions are affected by CVE-2020-7804?
It affects 1 product.
Products include Handysoft Groupware.
How do I fix CVE-2020-7804?
No fix has been published for CVE-2020-7804 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-7804 being exploited?
There is no known exploitation of CVE-2020-7804 in the wild and no public exploit code.
Other vulnerabilities in HandySoft Groupware(HShell.dll) for for Windows 7, 8, 10
Sources
Also known as GHSA-ww69-xxhg-pc55.