GHSA-MVGM-C55V-5WJW严重未审查

无摘要

OSV 1.4.0 · unreviewed · 修改于 2022-07-13 08:01

发布时间

2022-02-15 08:02

GitHub 审查时间

—

NVD 发布时间

2022-02-14 22:15

源文件

advisories/unreviewed/2022/02/GHSA-mvgm-c55v-5wjw/GHSA-mvgm-c55v-5wjw.json

公告说明

** UNSUPPORTED WHEN ASSIGNED ** Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note: the product has not been supported since 2018 and should be removed or replaced.

受影响的软件包

该公告没有提供结构化的受影响软件包信息。

参考链接

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-45420

标识信息

别名 / CVE

CVE-2021-45420

CWE

CWE-200CWE-287

软件生态

无

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

原始 OSV JSON

{
  "id": "GHSA-mvgm-c55v-5wjw",
  "aliases": [
    "CVE-2021-45420"
  ],
  "details": "** UNSUPPORTED WHEN ASSIGNED ** Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to denial of service and potentially remote code execution. Note: the product has not been supported since 2018 and should be removed or replaced.",
  "affected": [],
  "modified": "2022-07-13T00:01:50Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "published": "2022-02-15T00:02:46Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45420",
      "type": "ADVISORY"
    },
    {
      "url": "https://www.swascan.com/emerson",
      "type": "WEB"
    },
    {
      "url": "http://dixell.com",
      "type": "WEB"
    },
    {
      "url": "http://emerson.com",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-287"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
    "nvd_published_at": "2022-02-14T14:15:00Z",
    "github_reviewed_at": null
  }
}