CVE: CVE-2007-1253

Export to Word

Eval injection vulnerability in the (a) kmz_ImportWithMesh.py Script for Blender 0.1.9h, as used in (b) Blender before 2.43, allows user-assisted remote attackers to execute arbitrary Python code by importing a crafted (1) KML or (2) KMZ file.

Threat-Mapped Scoring

Score: 0.0

Priority: Unclassified

EPSS

Score: 0.02634
Percentile: 0.85085

CVSS Scoring

CVSS v2 Score: 9.3

Severity:

Mapped CWE(s)

CWE-94 : Improper Control of Generation of Code ('Code Injection')

All CAPEC(s)

CAPEC-242: Code Injection
CAPEC-35: Leverage Executable Code in Non-Executable Files
CAPEC-77: Manipulating User-Controlled Variables

CAPEC(s) with Mapped TTPs

CAPEC-35: Leverage Executable Code in Non-Executable Files
Mapped TTPs:
- T1027.006 : HTML Smuggling
- T1027.009 : Embedded Payloads
- T1564.009 : Resource Forking

Mapped ATT&CK TTPs

T1027.006 : HTML Smuggling
Kill Chain: defense-evasion
T1027.009 : Embedded Payloads
Kill Chain: defense-evasion
T1564.009 : Resource Forking
Kill Chain: defense-evasion

Malware

APTs Threat Group Associations

Campaigns

C0021

Affected Products

cpe:2.3:a:blender:blender:*:*:*:*:*:*:*:*
cpe:2.3:a:blender:blender:2.25:*:*:*:*:*:*:*
cpe:2.3:a:blender:blender:2.36:*:*:*:*:*:*:*
cpe:2.3:a:blender:blender:2.37a:*:*:*:*:*:*:*

← Back to Home