CVE-2021-42342

CRITICAL

9.8

Description

An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. In the file upload filter, user form variables can be passed to CGI scripts without being prefixed with the CGI prefix. This permits tunneling untrusted environment variables into vulnerable CGI scripts.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie10/14/2021

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

embedthis:goahead

Faiblesses (CWE)

CWE-434

References

https://github.com/embedthis/goahead/issues/305(cve@mitre.org)

https://github.com/embedthis/goahead/issues/305(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.