CVE-2011-5158

Published: Sep 7, 2012Modified: Apr 29, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

Multiple untrusted search path vulnerabilities in the DMTGUI2.EXE and DvInesLogFileViewer.Exe components in DATEV Grundpaket Basis CD23.20 allow local users to gain privileges via a Trojan horse (1) DVBSKNLANG101.dll or (2) DvZediTermSrvInfo004.dll file in the current working directory, as demonstrated by a directory that contains a .dmt, .adl, .c02, .dof, or .jrf file. NOTE: some of these details are obtained from third party information.

Affected (1)

Products: Datev: Grundpaket Basis

1 product

Grundpaket Basis

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Datev Grundpaket Basis	Version cd23.20

Related CWEs

Untrusted Search Path

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

References (4)

http://secunia.com/advisories/42940

Source: cve@mitre.org

Third Party Advisory

http://sotiriu.de/adv/NSOADV-2010-010.txt

Source: cve@mitre.org

ExploitThird Party Advisory

http://secunia.com/advisories/42940

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://sotiriu.de/adv/NSOADV-2010-010.txt

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.