Thanks to visit codestin.com
Credit goes to www.scribd.com

Scribd
Upload
37 views1 page

WPS Office Vulns Report

Two critical vulnerabilities have been identified in Kingsoft WPS Office affecting versions 12.2.0.13110 to 12.2.0.13489 and earlier than 12.2.0.17153, respectively. The first vulnerability allows path traversal through the Hyperlink Handler component, while the second permits DLL hijacking via improper path validation. Remediation includes upgrading to version 12.2.0.17153 or later and implementing various security settings to mitigate the risks.

Uploaded by

Abdo Bodabous
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
37 views1 page

WPS Office Vulns Report

Two critical vulnerabilities have been identified in Kingsoft WPS Office affecting versions 12.2.0.13110 to 12.2.0.13489 and earlier than 12.2.0.17153, respectively. The first vulnerability allows path traversal through the Hyperlink Handler component, while the second permits DLL hijacking via improper path validation. Remediation includes upgrading to version 12.2.0.17153 or later and implementing various security settings to mitigate the risks.

Uploaded by

Abdo Bodabous
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 1

WPS Office vulnerabilities (August 2024)

Kingsoft WPS Office Path Traversal CVEID : CVE-2024-7262 score 7.8


Vulnerability
Description Affected Affected versions Impact Remediation
components
 A vulnerability was found in  Upgrade to WPS Office version
Kingsoft WPS Office on Windows. It 12.2.0.17153 or later or :
has been rated as critical. The issue  WPS Office  from 12.2.0.13110 (including)  Direct Volume  Disable automatic hyperlink
affects the file to 12.2.0.13489 (including) Access (T1006) handling in WPS Office settings.
‘promecefpluginhost.exe’ in the  Use Windows Group Policy to
Hyperlink Handler component. The block the execution of ‘prome-
vulnerability allows path traversal, cefpluginhost.exe’.
requiring local access to exploit.  Adjust file associations to pre-
vent WPS Office from
handling hyperlink files.

Kingsoft WPS Office DLL Hijacking CVEID : CVE-2024-7263 score 7.8


Description Affected Affected versions Impact Remediation
components
 Improper path validation in  Upgrade to WPS Office version
‘promecefpluginhost.exe’ in Kingsoft 12.2.0.17153 or later, where this
WPS Office on Windows allows an  WPS Office  from 2.2.0.13110 (including)  Hijack Execution vulnerability has been
attacker to load an arbitrary to 12.2.0.17153 (excluding) Flow: DLL Side- mitigated by enhanced input
Windows DLL library. The patch Loading validation and restrictions on
released in version 12.2.0.16909 to (T1574.002) hyperlink parameters.
mitigate CVE-2024-7262 was not
restrictive enough, leading to
arbitrary library execution.

You might also like