CVE-2021-27197

DSUtility.dll in Pelco Digital Sentry Server before 7.19.67 has an arbitrary file write vulnerability. The AppendToTextFile method doesn't check if it's being called from the application or from a malicious user. The vulnerability is triggered when a remote attacker crafts an HTML page (e.g., with "OBJECT classid=" and "<SCRIPT language='vbscript'>") to overwrite arbitrary files.

DSUtility.dll in Pelco Digital Sentry Server before 7.19.67 has an arbitrary file write vulnerability. The AppendToTextFile method doesn't check if it's being called from the application or from a malicious user. The vulnerability is triggered when a remote attacker crafts an HTML page (e.g., with "OBJECT classid=" and "<SCRIPT language='vbscript'>") to overwrite arbitrary files.

DSUtility.dll en Pelco Digital Sentry Server versiones anteriores a 7.19.67, presenta una vulnerabilidad de escritura de archivo arbitraria.&#xa0;El método AppendToTextFile no comprueba si se llama desde la aplicación o desde un usuario malicioso.&#xa0;La vulnerabilidad es activada cuando un atacante remoto crea una página HTML (por ejemplo, con "OBJECT classid=" and "(SCRIPT language='vbscript')") para sobrescribir archivos arbitrarios