CVE-2021-36711
CVE-2021-36711
Vexday Risk Score
28Low
SSVC decision (CISA)
Attend
PoC available → attend closely
Exploit maturity
Proof of concept
Public proof of concept exists, but not yet automated.
CVSS —EPSS 15.5%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
16 Jul 2022Published on NVD
21 Jul 2022Public PoC
Weaponization speed
4 daysto first PoC
Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.
Recommendation: Plan a near-term fix — a public PoC already exists.
WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled.
Affected products
n/a · n/apublic PoCs found — 3
cve_referencepacketstormsecurity.com/files/167780/OctoBot-WebInterface-0.4.3-Remote-Code-Execution.htmlunverifiedcve_referencepacketstormsecurity.com/files/167721/Sashimi-Evil-OctoBot-Tentacle.htmlunverifiedexploitdbwww.exploit-db.com/exploits/50979unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://packetstormsecurity.com/files/167780/OctoBot-WebInterface-0.4.3-Remote-Code-Execution.htmlhttps://github.com/Drakkar-Software/OctoBot/blob/master/CHANGELOG.mdhttps://github.com/Drakkar-Software/OctoBot/issues/1966https://github.com/Nwqda/Sashimi-Evil-OctoBot-Tentaclehttps://packetstormsecurity.com/files/167721/Sashimi-Evil-OctoBot-Tentacle.htmlhttps://www.octobot.online/