CVE-2021-29995

EPSS 4.2%

Vexday Risk Score

23Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS —EPSS 4.2%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

09 Jun 2021Published on NVD

29 Jul 2021Public PoC

Weaponization speed

49 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

A Cross Site Request Forgery (CSRF) issue in Server Console in CloverDX through 5.9.0 allows remote attackers to execute any action as the logged-in user (including script execution). The issue is resolved in CloverDX 5.10, CloverDX 5.9.1, CloverDX 5.8.2, and CloverDX 5.7.1.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/163697/CloverDX-5.9.0-Code-Execution-Cross-Site-Request-Forgery.htmlunverified exploitdbwww.exploit-db.com/exploits/50166unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/163697/CloverDX-5.9.0-Code-Execution-Cross-Site-Request-Forgery.html https://support1.cloverdx.com/hc/en-us/articles/360021006520 https://support.cloverdx.com/releases/