CVE-2021-22678: Input Validation

Reference Links

• https://us-cert.cisa.gov/ics/advisories/icsa-21-112-01
• https://www.cisa.gov/news-events/ics-advisories/icsa-21-112-01 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• ICSA-21-112-01

Frequently Asked Questions

• What is CVE-2021-22678?

  CVE-2021-22678 is a vulnerability in Cscape, all versions prior to 9.90 SP4, that lacks proper validation of user-supplied data when parsing project files, potentially leading to memory corruption and code execution.

• How severe is CVE-2021-22678?

  CVE-2021-22678 has a severity rating of 7.8 (high).

• Which software versions are affected by CVE-2021-22678?

  All versions of Cscape prior to 9.90 SP4 are affected by CVE-2021-22678.

• What is the CWE classification for CVE-2021-22678?

  CVE-2021-22678 is classified under CWE-787 (Out-of-bounds Write) and CWE-20 (Improper Input Validation).

• How can an attacker exploit CVE-2021-22678?

  An attacker can leverage CVE-2021-22678 to execute code in the context of the current process by exploiting the lack of proper validation of user-supplied data when parsing project files.