According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? An attacker must send the user a malicious file and convince them to open it. What privileges could be gained by an attacker who successfully exploited the vulnerability? Low-privilege attackers who successfully exploited the vulnerability could potentially write malicious configurations and download malicious files. According to the CVSS metric, user interaction is required (UI:R) and privileges required is low (PR:L). What does that mean for this vulnerability? An authorized attacker must send the user a malicious file and convince the user to open it.
<a href="https://github.com/ycdxsb">ycdxsb</a> with <a href="http://www.iie.ac.cn/">VARAS@IIE</a>