CVE-2016-7845

GigaCC OFFICE ver.2.3 and earlier allows remote attackers to upload arbitrary files as a user profile image, which may be exploited for…

Medium6.5EPSS 1.4%

Published: 2 Aug 2017
Updated: 6 Aug 2024
Reserved: 9 Sept 2016
Assigned by: jpcert

Description

GigaCC OFFICE ver.2.3 and earlier allows remote attackers to upload arbitrary files as a user profile image, which may be exploited for unauthorized file sharing.

Timeline

2016
9 Sept 2016
9 Sept 2016
ID reserved
By jpcert
2017
2 Aug 201711 months later
2 Aug 2017· 11 months later
Published
2024
6 Aug 20247 years later
6 Aug 2024· 7 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2016-7845, by who scored it
Scored by	CVSS	Score	Vector
NVDNVD · Modified	3.0	Medium6.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

EPSS (exploitation in 30 days): 1.4% · top 27% of all CVEs (8 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

Unrestricted Upload of File with Dangerous Type
CWE-264 (opens in a new tab)All about CWE-264 and its CVEs

Affected products

WAM!NET Japan K.K. · GigaCC OFFICE
- affected ver.2.3 and earlier

References (3)

https://asp.gigacc.com/user/publicurl/view.do%3Bjsessionid=28438FE401A764B7CEDB3664AB2AC67C.ap04?job=view&direct=true&TI=9l1sf6jfp0bafkv9bh2e5fs43k&ID=9qbnmp2qetc5u9vc8crqbl804s (opens in a new tab)x_refsource_MISCx_transferred
95680 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
https://jvn.jp/en/vu/JVNVU91417143/index.html (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2016-7845](https://cveledger.app/badge/CVE-2016-7845.svg)](https://cveledger.app/cve/CVE-2016-7845)

Record last updated 6 Aug 2024, 02:04 UTC.