CVE-2021-38451 AUVESY Versiondog
Attackers can read out-of-bounds memory via unsanitized offset parameters in the proprietary protocol, exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-38451?
CVE-2021-38451 is a medium-severity vulnerability in AUVESY Versiondog, published on 22 Oct 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The affected product’s proprietary protocol CSC allows for calling numerous function codes. In order to call those function codes, the user must supply parameters. There is no sanitation on the value of the offset, which allows the client to specify any offset and read out-of-bounds data.
Weakness: CWE-125
Which versions are affected by CVE-2021-38451?
It affects 1 product.
Products include Auvesy Versiondog.
How do I fix CVE-2021-38451?
No fix has been published for CVE-2021-38451 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-38451 being exploited?
There is no known exploitation of CVE-2021-38451 in the wild and no public exploit code.
Other vulnerabilities in AUVESY Versiondog
Sources
Also known as GHSA-f5r8-j6cr-3q26.