CVE-2021-38697

Опубликовано: 18 янв. 2022

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

SoftVibe SARABAN for INFOMA 1.1 allows Unauthenticated unrestricted File Upload, that allows attackers to upload files with any file extension which can lead to arbitrary code execution.

Ссылки

http://www.infoma.net/index.php/saraban/
Product
https://orangeo.tech/post/2021/12/24/First-CVEs.html
Exploit
Third Party Advisory
URL Repurposed
https://play.google.com/store/apps/details?id=th.co.softvibe.saraban&hl=en&gl=US
Product
https://sawatdee.github.io/post/2021/12/24/First-CVEs.html
Exploit
Third Party Advisory
http://www.infoma.net/index.php/saraban/
Product
https://orangeo.tech/post/2021/12/24/First-CVEs.html
Exploit
Third Party Advisory
URL Repurposed
https://play.google.com/store/apps/details?id=th.co.softvibe.saraban&hl=en&gl=US
Product
https://sawatdee.github.io/post/2021/12/24/First-CVEs.html
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:softvibe:saraban:1.1:*:*:*:*:infoma:*:*

EPSS

Процентиль: 81%

0.01555

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-434

Связанные уязвимости

GHSA-88pw-4rw2-v435