{"api_version":"1","generated_at":"2026-07-23T16:44:43+00:00","cve":"CVE-2020-7838","urls":{"html":"https://cve.report/CVE-2020-7838","api":"https://cve.report/api/cve/CVE-2020-7838.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-7838","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-7838"},"summary":{"title":"CVE-2020-7838","description":"A arbitrary code execution vulnerability exists in the way that the Stove client improperly validates input value. An attacker could execute arbitrary code when the user access to crafted web page. This issue affects: Smilegate STOVE Client 0.0.4.72.","state":"PUBLIC","assigner":"vuln@krcert.or.kr","published_at":"2020-12-18 01:15:00","updated_at":"2020-12-21 21:49:00"},"problem_types":["CWE-20"],"metrics":[],"references":[{"url":"https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35851","name":"https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35851","refsource":"MISC","tags":["Third Party Advisory"],"title":"KrCERT/CC - KISA 인터넷 보호나라&KrCERT","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7838","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7838","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"LEGACY","value":"Hangjun Ko","lang":""}],"nvd_cpes":[{"cve_year":"2020","cve_id":"7838","vulnerable":"-1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"microsoft","cpe5":"windows","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"7838","vulnerable":"0","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"microsoft","cpe5":"windows","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"7838","vulnerable":"1","versionEndIncluding":"0.0.4.71","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"onstove","cpe5":"stove","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"vuln@krcert.or.kr","ID":"CVE-2020-7838","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"STOVE Client","version":{"version_data":[{"version_value":"0.0.4.72"}]}}]},"vendor_name":"Smilegate"}]}},"credit":[{"lang":"eng","value":"Hangjun Ko"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A arbitrary code execution vulnerability exists in the way that the Stove client improperly validates input value. An attacker could execute arbitrary code when the user access to crafted web page. This issue affects: Smilegate STOVE Client 0.0.4.72."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-20 Improper Input Validation"}]}]},"references":{"reference_data":[{"refsource":"MISC","url":"https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35851","name":"https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35851"}]},"source":{"discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2020-12-18 01:15:00","lastModifiedDate":"2020-12-21 21:49:00","problem_types":["CWE-20"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6.8},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"AND","children":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:onstove:stove:*:*:*:*:*:*:*:*","versionStartIncluding":"0.0.4.10","versionEndIncluding":"0.0.4.71","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":false,"cpe23Uri":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","cpe_name":[]}]}],"cpe_match":[]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"7838","Ordinal":"168121","Title":"CVE-2020-7838","CVE":"CVE-2020-7838","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"7838","Ordinal":"1","NoteData":"A arbitrary code execution vulnerability exists in the way that the Stove client improperly validates input value. An attacker could execute arbitrary code when the user access to crafted web page. This issue affects: Smilegate STOVE Client 0.0.4.72.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"7838","Ordinal":"2","NoteData":"2020-12-17","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"7838","Ordinal":"3","NoteData":"2020-12-17","Type":"Other","Title":"Modified"}]}}}