← Volver a CVEs
CVE-2021-26473
CRITICAL9.8
Descripcion
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by calling the file via the web server.
Detalles CVE
Puntuacion CVSS v3.19.8
SeveridadCRITICAL
Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vector de ataqueNETWORK
ComplejidadLOW
Privilegios requeridosNONE
Interaccion usuarioNONE
Publicado6/8/2021
Ultima modificacion11/21/2024
Fuentenvd
Avistamientos honeypot0
Productos afectados
vembu:bdr_suitevembu:offsite_dr
Debilidades (CWE)
CWE-434
Referencias
https://csirt.divd.nl/2021/05/11/Vembu-zero-days/(cve@mitre.org)
https://csirt.divd.nl/cases/DIVD-2020-00011/(cve@mitre.org)
https://csirt.divd.nl/cves/CVE-2021-26473/(cve@mitre.org)
https://www.wbsec.nl/vembu(cve@mitre.org)
https://csirt.divd.nl/2021/05/11/Vembu-zero-days/(af854a3a-2127-422b-91ae-364da2661108)
https://csirt.divd.nl/cases/DIVD-2020-00011/(af854a3a-2127-422b-91ae-364da2661108)
https://csirt.divd.nl/cves/CVE-2021-26473/(af854a3a-2127-422b-91ae-364da2661108)
https://www.wbsec.nl/vembu(af854a3a-2127-422b-91ae-364da2661108)
Correlaciones IOC
Sin correlaciones registradas
This product uses data from the NVD API but is not endorsed or certified by the NVD.