CVE-2021-47762
BaseFortify
Publication date: 2026-01-15
Last updated on: 2026-01-15
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| unknown_vendor | httpdebuggerpro | 9.11 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-428 | The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an unquoted service path issue in HTTPDebuggerPro version 9.11. Because the service path to the executable is not enclosed in quotes, a local attacker can place a malicious executable in a path that the system misinterprets. When the service starts, it may execute the malicious code instead of the intended executable, allowing the attacker to run arbitrary code with elevated system privileges. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability allows a local attacker to execute arbitrary code with elevated system privileges. This means the attacker can gain high-level access to the system, potentially leading to full system compromise, unauthorized data access, or disruption of system operations. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for unquoted service paths in the Windows service configuration for HTTPDebuggerPro. Specifically, you can use the command `sc qc HTTPDebuggerPro` in a Windows command prompt or PowerShell to query the service configuration and inspect the binary path. If the path to the executable is unquoted and contains spaces (e.g., C:\Program Files (x86)\HTTPDebuggerPro\HTTPDebuggerSvc.exe without quotes), the system is vulnerable to this issue. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, you should correct the service path by adding quotation marks around the executable path in the service configuration to prevent the system from misinterpreting the path. This can be done by editing the service configuration to quote the path, for example, changing it to "C:\Program Files (x86)\HTTPDebuggerPro\HTTPDebuggerSvc.exe". Additionally, ensure that only trusted users have local access to the system to reduce the risk of exploitation. [1]