CVE-2024-35205
High
Description
The WPS Office (aka cn.wps.moffice_eng) application before 17.0.0 for Android fails to properly sanitize file names before processing them through external application interactions, leading to a form of path traversal. This potentially enables any application to dispatch a crafted library file, aiming to overwrite an existing native library utilized by WPS Office. Successful exploitation could result in the execution of arbitrary commands under the guise of WPS Office's application ID.
SeverityHigh
CVSS7.8
Exploit probability—
ProductKingsoft Wps Office
PublishedMay 14, 2024
First seenMay 14, 2024
Weakness typeCWE-22Path traversal
How to fix
Update
- kingsoft wps_office17.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kingsoft wps_office | v < 17.0.0 | 17.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.