CVE-2021-41185

Download file outside intended directory

CVSS 8.8 HIGHEPSS 1.4%CWE-22

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 8.8EPSS 1.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

26 oct 2021Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Mycodo is an environmental monitoring and regulation system. An exploit in versions prior to 8.12.7 allows anyone with access to endpoints to download files outside the intended directory. A patch has been applied and a release made. Users should upgrade to version 8.12.7. As a workaround, users may manually apply the changes from the fix commit.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Productos afectados

kizniche · Mycodo

Referencias

https://github.com/kizniche/Mycodo/commit/23ac5dd422029c2b6ae1701a3599b6d41b66a6a9 https://github.com/kizniche/Mycodo/issues/1105 https://github.com/kizniche/Mycodo/releases/tag/v8.12.7 https://github.com/kizniche/Mycodo/security/advisories/GHSA-252r-94ph-m229