CVE-2017-17525 guiclient/guiclient.cpp in xTuple PostBooks 4.7.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct ar...
HighCVSS 8.8
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
guiclient/guiclient.cpp in xTuple PostBooks 4.7.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xtuple postbooks | = 4.7.0 | No fix listed |
References
- security-tracker.debian.org issue-tracking third-party-advisory