CVE-2020-7838 Code injection in STOVE Client
An attacker can execute arbitrary code on a user's system by tricking them into visiting a crafted web page using the STOVE Client.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-7838?
CVE-2020-7838 is a high-severity code injection vulnerability in Smilegate STOVE Client, published on 18 Dec 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A arbitrary code execution vulnerability exists in the way that the Stove client improperly validates input value. An attacker could execute arbitrary code when the user access to crafted web page. This issue affects: Smilegate STOVE Client 0.0.4.72.
Weakness: CWE-20
Which versions are affected by CVE-2020-7838?
It affects 1 product.
Products include Onstove Stove.
How do I fix CVE-2020-7838?
No fix has been published for CVE-2020-7838 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-7838 being exploited?
There is no known exploitation of CVE-2020-7838 in the wild and no public exploit code.
Sources
Also known as GHSA-q53r-4p37-g26v.