CVE-2021-38469 AUVESY Versiondog

Critical 9.1 Published 22 Oct 2021 Updated 16 Sep 2024

Attackers can execute arbitrary code by placing malicious DLLs in the application directory due to uncontrolled search path elements.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-38469?

CVE-2021-38469 is a critical vulnerability in AUVESY Versiondog, published on 22 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Many of the services used by the affected product do not specify full paths for the DLLs they are loading. An attacker can exploit the uncontrolled search path by implanting their own DLL near the affected product’s binaries, thus hijacking the loaded DLL.

Weakness: CWE-427

Which versions are affected by CVE-2021-38469?

It affects 1 product.

Products include Auvesy Versiondog.

How do I fix CVE-2021-38469?

No fix has been published for CVE-2021-38469 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-38469 being exploited?

There is no known exploitation of CVE-2021-38469 in the wild and no public exploit code.

Sources

Also known as GHSA-p8fh-8437-rr8p.