CVE-2021-32538
Assigner: twcert
Published: 2021-07-02T00:00:00
State: PUBLISHED
affected: product: CMS
vendor: ARTWARE
versions: lessThanOrEqual: 2021/1/8
status: affected
version: unspecified
versionType: custom
datePublic: 2021-07-02T00:00:00
descriptions: value: ARTWARE CMS parameter of image upload function does not filter the type of upload files which allows remote attackers can upload arbitrary files without logging in, and further execute code unrestrictedly.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
type: CWE
solutions: value: Contact tech support from ARTWARE.
source: advisory: TVN-202107001
discovery: EXTERNAL
title: ARTWARE CMS - Unrestricted Upload of File
x_generator: engine: Vulnogram 0.0.9